Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
20/06/2024, 16:49
General
-
Target
Wave.exe
-
Size
6.6MB
-
MD5
0da2b181981239146eb1d216029207e8
-
SHA1
0bbc5a73f385be44301157b27a3674591ff03d09
-
SHA256
d222ec6dd3957a8fdec2dd14a3718ba2c9acae96e3476aced7d754bc19ecb03f
-
SHA512
6b5e29a0c90d46caa442fa92a56370c7ec19f22a7f64b498e5b87e97958eb802694f191248a9265d2c457e9df2ca5a1a7dcafcc7249ba7800234895b3e911b4b
-
SSDEEP
98304:rsOBVM2qwlj5awdv56s1Qr3iP4dtVOFyBwKQqHJTIXviT5AIWNZeJJPl4yNSYGl2:r5j5ao5pQrS8qFnKQ62qCIVPlDNF
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"8⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"17⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"58⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"64⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"66⤵
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"66⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\ugo.0.exe"C:\Users\Admin\AppData\Local\Temp\ugo.0.exe"67⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"68⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "69⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"70⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\u3ao.0.exe"C:\Users\Admin\AppData\Local\Temp\u3ao.0.exe"66⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "68⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"69⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\u15k.0.exe"C:\Users\Admin\AppData\Local\Temp\u15k.0.exe"65⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"66⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "67⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"68⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\u3ts.0.exe"C:\Users\Admin\AppData\Local\Temp\u3ts.0.exe"64⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"65⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "66⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"67⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\u28w.0.exe"C:\Users\Admin\AppData\Local\Temp\u28w.0.exe"63⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"64⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "65⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"66⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\u3vg.0.exe"C:\Users\Admin\AppData\Local\Temp\u3vg.0.exe"62⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "64⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\u30w.0.exe"C:\Users\Admin\AppData\Local\Temp\u30w.0.exe"61⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"62⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "63⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\u3do.0.exe"C:\Users\Admin\AppData\Local\Temp\u3do.0.exe"60⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "62⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\u2os.0.exe"C:\Users\Admin\AppData\Local\Temp\u2os.0.exe"59⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"60⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "61⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"57⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\u3wk.0.exe"C:\Users\Admin\AppData\Local\Temp\u3wk.0.exe"58⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"59⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "60⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\u1g0.0.exe"C:\Users\Admin\AppData\Local\Temp\u1g0.0.exe"57⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"58⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "59⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\ubg.0.exe"C:\Users\Admin\AppData\Local\Temp\ubg.0.exe"56⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"57⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "58⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\u8o.0.exe"C:\Users\Admin\AppData\Local\Temp\u8o.0.exe"55⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"56⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "57⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\u1oo.0.exe"C:\Users\Admin\AppData\Local\Temp\u1oo.0.exe"54⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "56⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\u3ns.0.exe"C:\Users\Admin\AppData\Local\Temp\u3ns.0.exe"53⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"54⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "55⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\u1zw.0.exe"C:\Users\Admin\AppData\Local\Temp\u1zw.0.exe"52⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "54⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\u8o.0.exe"C:\Users\Admin\AppData\Local\Temp\u8o.0.exe"51⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"52⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "53⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\u3bs.0.exe"C:\Users\Admin\AppData\Local\Temp\u3bs.0.exe"50⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "52⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\u2kk.0.exe"C:\Users\Admin\AppData\Local\Temp\u2kk.0.exe"49⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"50⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "51⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\u3is.0.exe"C:\Users\Admin\AppData\Local\Temp\u3is.0.exe"48⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"49⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "50⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\ux8.0.exe"C:\Users\Admin\AppData\Local\Temp\ux8.0.exe"47⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"48⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "49⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\u3sw.0.exe"C:\Users\Admin\AppData\Local\Temp\u3sw.0.exe"46⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "48⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\u1zw.0.exe"C:\Users\Admin\AppData\Local\Temp\u1zw.0.exe"45⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"46⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "47⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"48⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\uwg.0.exe"C:\Users\Admin\AppData\Local\Temp\uwg.0.exe"44⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"45⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "46⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\u1f0.0.exe"C:\Users\Admin\AppData\Local\Temp\u1f0.0.exe"43⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"44⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "45⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\u1ww.0.exe"C:\Users\Admin\AppData\Local\Temp\u1ww.0.exe"42⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "44⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\uqw.0.exe"C:\Users\Admin\AppData\Local\Temp\uqw.0.exe"41⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"42⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "43⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\u118.0.exe"C:\Users\Admin\AppData\Local\Temp\u118.0.exe"40⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "42⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\uhs.0.exe"C:\Users\Admin\AppData\Local\Temp\uhs.0.exe"39⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"40⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "41⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\ux0.0.exe"C:\Users\Admin\AppData\Local\Temp\ux0.0.exe"38⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "40⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\u19c.0.exe"C:\Users\Admin\AppData\Local\Temp\u19c.0.exe"37⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"38⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "39⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\un0.0.exe"C:\Users\Admin\AppData\Local\Temp\un0.0.exe"36⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "38⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\u22g.0.exe"C:\Users\Admin\AppData\Local\Temp\u22g.0.exe"35⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"36⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "37⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\u3rw.0.exe"C:\Users\Admin\AppData\Local\Temp\u3rw.0.exe"34⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "36⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\u3n0.0.exe"C:\Users\Admin\AppData\Local\Temp\u3n0.0.exe"33⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"34⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "35⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\u2ys.0.exe"C:\Users\Admin\AppData\Local\Temp\u2ys.0.exe"32⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "34⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\uf0.0.exe"C:\Users\Admin\AppData\Local\Temp\uf0.0.exe"31⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"32⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "33⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\u1us.0.exe"C:\Users\Admin\AppData\Local\Temp\u1us.0.exe"30⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "32⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"33⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\u204.0.exe"C:\Users\Admin\AppData\Local\Temp\u204.0.exe"29⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"30⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "31⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"32⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\uqc.0.exe"C:\Users\Admin\AppData\Local\Temp\uqc.0.exe"28⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "30⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\u35k.0.exe"C:\Users\Admin\AppData\Local\Temp\u35k.0.exe"27⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"28⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "29⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"30⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\u22c.0.exe"C:\Users\Admin\AppData\Local\Temp\u22c.0.exe"26⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"27⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "28⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\u2h0.0.exe"C:\Users\Admin\AppData\Local\Temp\u2h0.0.exe"25⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"26⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "27⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unk.0.exe"C:\Users\Admin\AppData\Local\Temp\unk.0.exe"24⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "26⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u2eg.0.exe"C:\Users\Admin\AppData\Local\Temp\u2eg.0.exe"23⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "25⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"21⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u1ww.0.exe"C:\Users\Admin\AppData\Local\Temp\u1ww.0.exe"22⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "24⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u3gc.0.exe"C:\Users\Admin\AppData\Local\Temp\u3gc.0.exe"21⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "23⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"19⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u8o.0.exe"C:\Users\Admin\AppData\Local\Temp\u8o.0.exe"20⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "22⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"18⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u2lo.0.exe"C:\Users\Admin\AppData\Local\Temp\u2lo.0.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "21⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"17⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u1rs.0.exe"C:\Users\Admin\AppData\Local\Temp\u1rs.0.exe"18⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"19⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "20⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"16⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u290.0.exe"C:\Users\Admin\AppData\Local\Temp\u290.0.exe"17⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "19⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u2u8.0.exe"C:\Users\Admin\AppData\Local\Temp\u2u8.0.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"17⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "18⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u35w.0.exe"C:\Users\Admin\AppData\Local\Temp\u35w.0.exe"15⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"16⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "17⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"13⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u2dw.0.exe"C:\Users\Admin\AppData\Local\Temp\u2dw.0.exe"14⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "16⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u2ww.0.exe"C:\Users\Admin\AppData\Local\Temp\u2ww.0.exe"13⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"14⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "15⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u1xk.0.exe"C:\Users\Admin\AppData\Local\Temp\u1xk.0.exe"12⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "14⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u2wo.0.exe"C:\Users\Admin\AppData\Local\Temp\u2wo.0.exe"11⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "13⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u3qo.0.exe"C:\Users\Admin\AppData\Local\Temp\u3qo.0.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "12⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u1dc.0.exe"C:\Users\Admin\AppData\Local\Temp\u1dc.0.exe"9⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "11⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\uas.0.exe"C:\Users\Admin\AppData\Local\Temp\uas.0.exe"8⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "10⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u3cs.0.exe"C:\Users\Admin\AppData\Local\Temp\u3cs.0.exe"7⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "9⤵
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u1r8.0.exe"C:\Users\Admin\AppData\Local\Temp\u1r8.0.exe"6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "8⤵
- Suspicious use of WriteProcessMemory
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ux0.0.exe"C:\Users\Admin\AppData\Local\Temp\ux0.0.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u2ws.0.exe"C:\Users\Admin\AppData\Local\Temp\u2ws.0.exe"4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"C:\Users\Admin\AppData\Local\Temp\j25aynuw.123.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u3wg.0.exe"C:\Users\Admin\AppData\Local\Temp\u3wg.0.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\portfontDriverRef\ComcontainerAgentServer.exe"C:\portfontDriverRef/ComcontainerAgentServer.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pksuDlslcW.bat"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
847B
MD566a0a4aa01208ed3d53a5e131a8d030a
SHA1ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1
SHA256f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8
SHA512626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
416KB
MD5459c4444f5fa7bda21ce1cfcfd73eeb3
SHA1fae0300475ac000bdee75729be001cf3e73e1a5c
SHA2561b176badfb2c11c6317cd796e7b136723da935d6bd7cd312a200474518710905
SHA512c65d0883fff87270e09cf5001ff98c7928baf851b496e423f4759479b6292c782a6a2406b8ae01afb34009c3fa675019fe9d3e3f070c87bb1df1b1b05fa9669a
-
Filesize
2.1MB
MD5f8dde99b16e81802213092d8c3e280f4
SHA144b5c84264574ec0c86b67c4ab33fe3d2e943867
SHA25607cb90a5763dcbe32c14d520aa28ee83a776637c270e11436e64fccc7ff2a9ce
SHA5122b2bdeaf101633677ebe81ddb6fd2cb95846340ca57b3e5305dea848085fa912c413f25bac71c8bf7c219739a0293b1fde3028fb887997ec6296fc37993e4cde
-
Filesize
1.8MB
MD5e1ad20cdbfd4857fbdf11d4ab45131bb
SHA1f07dd6c0e5ffa517d790d817faa800a2b670e56d
SHA25652b91368ca96fa2491609a71f6104c39024edc8ef9c008dce0de50d071c9358c
SHA5124127b963a45f36596550b1f69dc382e9b2a666ab4a7ece73d5c863cdff8dd0090a7b6b29c0e4bf82f61a38396d29ec4f4b10f68eb256abf84e7fcc12f4ecb1a7
-
Filesize
103B
MD5eaceac8f39a0d99832897d1efdd398ed
SHA1e3c0fa71bfe36b4e98662fe3fd5b30f81975b581
SHA2564e8ff63a015f9ca5f3d43fa6f5447ebba1030104843f2cd9efd36925b0e3f3f1
SHA512a18fb3d7d79b51db194f7eebcce9dfb56f4a978737c8a78133a6d2ebd68f089f9c7e2188ea99fb214114ed27d407dc5b4ee30f7c6be56ed5be243d42ca037e87
-
Filesize
220B
MD5b01d5e80ad2526f67db23cda304c5a29
SHA1e43a72b46b12c5579b13ebdd7d179753a8a98081
SHA25615d8584d153568c0ab6607e22ba272c8bc263668150c29c62c2989095b349395
SHA51247ad3537d796462284c9000ddfe6b92c953a8405a5bea61dd80da0d4454816eac9b1bdd505232a4fb4ddf145dc8f8b5618041bab7e3649ca7a821230af1ff2df
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
6.7MB
-
Filesize
1.9MB
-
Filesize
112KB
-
Filesize
320KB
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
1.1MB
-
Filesize
360KB
-
Filesize
1.1MB