Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
14-06-2024 18:43
General
-
Target
Alpha.exe
-
Size
17.7MB
-
MD5
000049c16395549f6ee5d8d462ea999d
-
SHA1
f008c8c3edae6e5b934f4d21576aab437a32214a
-
SHA256
f0198c0a0d120daa97da38b5c6d9c02084f643306729da7e5cf3fdfe436af05a
-
SHA512
4a215294593191155c7425a96474b5fc52a9818b6068e4db9e8438f4db66615be8f8e8f7e78915b915f997df19e7379154c646af8a880d90b9b5e6a59828c68c
-
SSDEEP
393216:GZo6fE7woeA8SdC0kn3e6pNKm0jZ08PAcfQWV8fZhYxh0MFww0OO:GuJh8L0qOFmoAtNfjqh0MqO
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Umbral payload 2 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
DCRat payload 3 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"8⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"9⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"9⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"11⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"12⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"14⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"14⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"15⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"16⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"17⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"17⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"18⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"18⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"19⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"20⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"26⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "28⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"25⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "27⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"24⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "26⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"23⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "25⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"22⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "24⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"21⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "23⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"21⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "22⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"19⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "21⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"18⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"19⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "20⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"17⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "19⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"16⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "18⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"15⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "17⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"14⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "16⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "15⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"12⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "14⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"11⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "13⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "12⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"10⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "11⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"8⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"9⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "10⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"7⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "9⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"7⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "8⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "7⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"3⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "5⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"2⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "4⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"2⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"5⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"11⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"13⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"16⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"18⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Alpha.exe"C:\Users\Admin\AppData\Local\Temp\Alpha.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"42⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"43⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"41⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"42⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"40⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"41⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "42⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"43⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"39⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"40⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "41⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"42⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"38⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "40⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"41⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"37⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"38⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "39⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"40⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"36⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "38⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"39⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"35⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"36⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "37⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"34⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "36⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"33⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"34⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "35⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"32⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"33⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "34⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"31⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"32⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "33⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"30⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"31⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "32⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"33⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"29⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"30⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "31⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"32⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"28⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"29⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "30⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"27⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"28⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "29⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"30⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"26⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "28⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"25⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "27⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"28⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"24⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "26⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"23⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "25⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"22⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "24⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"21⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "23⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"20⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "22⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"19⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "21⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"18⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "20⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"17⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "19⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"16⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "18⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"15⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "17⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"18⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"14⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "16⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"17⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"13⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "15⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"16⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"12⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"13⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "14⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"15⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"11⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"12⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "13⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"14⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"10⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "12⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"13⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"9⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "11⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"12⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"8⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "10⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"11⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"7⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "9⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"10⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"6⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "8⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"5⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"6⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "7⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "6⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"3⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"4⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"C:\Users\Admin\AppData\Local\Temp\oxotana4iterov.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\gn4kMFDzyxtNMy.vbe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\t57a9grPX.bat" "4⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
1KB
MD54c8fa14eeeeda6fe76a08d14e08bf756
SHA130003b6798090ec74eb477bbed88e086f8552976
SHA2567ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5
SHA512116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116
-
Filesize
1KB
MD55cb90c90e96a3b36461ed44d339d02e5
SHA15508281a22cca7757bc4fbdb0a8e885c9f596a04
SHA25634c15d8e79fef4bddec7e34f3426df3b68f8fc6deac29ea12d110f6c529fe3bb
SHA51263735938c841c28824e3482559df18839930acc5ea8600b1074439b70a2f600a92f41593568e49991f25f079e7f7361b4f1678feadbf004f6e9e4d51d36598d4
-
Filesize
231KB
MD55b57c2fc989cac662bfb47a701607c41
SHA18f079e17ac8ff6de547da26b1f4673220551d039
SHA2569ec87e65f1973fe732713bfdccdab7a5e3b8e4ef99f87e05fe20a692d4af0bdd
SHA512d83bc196a38f6858aae02a69e4436e3109723b9e2323085c0cbee418e5e7e966500fc97ec8e56b37f7a3a2574db2c41992f16ef55afecc5559a655b1e6fe9a00
-
Filesize
2.1MB
MD53c9a4df5825cffb82efd28341210cb5e
SHA1fb5c0017c470dfa2c068830c88e5aaf01fcf28c4
SHA2569bc59f729ffb4de1824b287b63044ec1f9a5b6d28e19ce4640f848fbd8738869
SHA51245b7af20b970c6546ff542a828918a0737003b2f8cdde38d7e95736e5b22ce89bd0535ffd46c634a02e8763415a36f75e037065e999a20d3d175df8f7c848d3b
-
Filesize
1.8MB
MD5a6d40fd838bb5e01cf15ecd8865b3716
SHA1d3ac362700cbc6c4732a68df61089acb69029348
SHA2565c50417c2c36617ee7e888a1a4dc02977fddcca617d84c2e5dbd1f172fd32870
SHA5123d3b9734a8a78104742af23261c2caabb309ff3f7d237946182f7a07b8f5275a289191da6d19f0883ef7c499f098887e23b3dd06c0ccbeada8e1f721a7e65a59
-
Filesize
192B
MD53d8415c7e490301c4e6cad33a74cfe18
SHA1703c9beb239ec68622a7691e3c4c1d3346cc12bd
SHA256d6058a9013556315506dd79d4fa4339b80b40cd0e6c3a781adabfbfad3548c2e
SHA512946c6ea4cb62829e964c0ef7601d6ec753e5d7c63d1c000a761c8e60fbff54882072640e86dc8faa905c9e684b04da067480430e90b59b6654f93b7c17367070
-
Filesize
23B
MD5cbad1e030a37190ced948f45d7582691
SHA1b1590dc4a67cd1b56b6b0ff42d48325de7bb8ea5
SHA2568d910a7da0bc8d3baf495648cc0fef5391e8d7486cfc027827d3828a488f7571
SHA512ce98091245080506c15afd1eba8847e410b43c689ef38b4c971881a0888588cbac39234d73f783ad4f4f113c7fe07d066d4f5e1a2181854b70a032f4308fca92
-
Filesize
1.8MB
-
Filesize
56KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
17.8MB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB