Malware Analysis Report

2024-10-10 09:57

Sample ID 240630-bpdrpa1fjc
Target 87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe
SHA256 87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95
Tags
umbral xmrig xworm evasion execution miner persistence rat spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95

Threat Level: Known bad

The file 87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe was found to be: Known bad.

Malicious Activity Summary

umbral xmrig xworm evasion execution miner persistence rat spyware stealer trojan upx

Xworm

Umbral

Detect Umbral payload

xmrig

Detect Xworm Payload

Detects executables packed with unregistered version of .NET Reactor

XMRig Miner payload

Detects executables containing possible sandbox system UUIDs

Detects executables attemping to enumerate video devices using WMI

Detects executables containing possible sandbox analysis VM names

Detects executables containing possible sandbox analysis VM usernames

UPX dump on OEP (original entry point)

Detects Windows executables referencing non-Windows User-Agents

Command and Scripting Interpreter: PowerShell

Stops running service(s)

Creates new service(s)

Drops file in Drivers directory

UPX packed file

Checks computer location settings

Reads user/profile data of web browsers

Drops startup file

Loads dropped DLL

.NET Reactor proctector

Executes dropped EXE

Adds Run key to start application

Power Settings

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Detects videocard installed

Scheduled Task/Job: Scheduled Task

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-30 01:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-30 01:18

Reported

2024-06-30 01:21

Platform

win7-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe"

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Umbral

stealer umbral

Xworm

trojan rat xworm

xmrig

miner xmrig

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM names

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox system UUIDs

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with unregistered version of .NET Reactor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Creates new service(s)

persistence execution

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe N/A

Stops running service(s)

evasion execution

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk C:\Users\Admin\AppData\Local\Temp\Nursultan.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nursultan Setup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nursultan Setup.exe" C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\Запустить Nursultan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Запустить Nursultan.exe" C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nursultan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nursultan.exe" C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1324 set thread context of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2904 set thread context of 1772 N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe C:\Windows\system32\conhost.exe
PID 2904 set thread context of 848 N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe C:\Windows\system32\svchost.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\wusa.lock C:\Windows\system32\wusa.exe N/A
File created C:\Windows\wusa.lock C:\Windows\system32\wusa.exe N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 90c8b7858bcada01 C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\discord-1199748644409184347 C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\discord-1199748644409184347\DefaultIcon C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\discord-1199748644409184347\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CrackLauncher.exe" C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\discord-1199748644409184347\ = "URL:Run game 1199748644409184347 protocol" C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\discord-1199748644409184347\URL Protocol C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\discord-1199748644409184347\shell\open\command C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\discord-1199748644409184347\shell C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\discord-1199748644409184347\shell\open C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\discord-1199748644409184347\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CrackLauncher.exe" C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2804 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe
PID 2804 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe
PID 2804 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe
PID 2804 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe
PID 2804 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe
PID 2804 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe
PID 2804 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
PID 2804 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
PID 2804 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
PID 2804 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
PID 2804 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2804 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2804 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 1264 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\system32\cmd.exe
PID 1264 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\system32\cmd.exe
PID 1264 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\system32\attrib.exe
PID 2696 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\system32\attrib.exe
PID 2696 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\system32\attrib.exe
PID 2696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1324 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1324 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1324 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1324 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1324 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1324 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1324 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1324 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 1324 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2696 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 2696 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe

"C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe'

C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe'

C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe

"C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan.exe'

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe

"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe'

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\system32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "XMRKNZQC"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "XMRKNZQC" binpath= "C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "XMRKNZQC"

C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe

C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe

svchost.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {890CA7D4-EC25-4A9E-8E64-F5F9EE524DA3} S-1-5-21-1340930862-1405011213-2821322012-1000:TICCAUTD\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 unknown-sunglasses.gl.at.ply.gg udp
US 147.185.221.20:28223 unknown-sunglasses.gl.at.ply.gg tcp
US 8.8.8.8:53 mine.bmpool.org udp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 147.185.221.20:28223 unknown-sunglasses.gl.at.ply.gg tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
N/A 127.0.0.1:28223 tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 147.185.221.20:28223 unknown-sunglasses.gl.at.ply.gg tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 147.185.221.20:28223 unknown-sunglasses.gl.at.ply.gg tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 147.185.221.20:28223 unknown-sunglasses.gl.at.ply.gg tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp

Files

memory/2804-0-0x000007FEF4D53000-0x000007FEF4D54000-memory.dmp

memory/2804-1-0x000000013FA80000-0x000000013FD80000-memory.dmp

memory/1624-6-0x0000000002C60000-0x0000000002CE0000-memory.dmp

memory/1624-7-0x000000001B580000-0x000000001B862000-memory.dmp

memory/1624-8-0x00000000021A0000-0x00000000021A8000-memory.dmp

\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe

MD5 a1d8db2a1ff742bc73dd5617083f5fde
SHA1 957b182d82efb40a36099dd886ad581977880838
SHA256 d715e599815190df86069fae7220db64b5999207f77fb6e41cfe318d34c7399a
SHA512 0c5407f5707e5f2808cf1d85d71815ca67d45edc8bd8a83cc424dc927afcbad6ced5a826fff81549e5684ca0ece039513c3351ce7bf231e37885f7ed04dc513f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 2d6a8fc2b00b792c50548812a6e06fc0
SHA1 c0a004b46a8a122b8008c77c631c0e91f7d1eb47
SHA256 f790f890d0af5c2f3ccf2be8dcca5813b3602e0d06b333dfabce3ed4fcb07e84
SHA512 689801f3ace1dc807be7db9a2b648127de32f88543800593f8e2bcdf3e94df1e805a13c8d81c7fbd4afa6c2443d142116e83ddf8f89d2eedc84cc48f13f06262

memory/2780-22-0x000000001B690000-0x000000001B972000-memory.dmp

memory/2780-23-0x0000000001E70000-0x0000000001E78000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe

MD5 f0b33cc162bfd36a995b8c90cd8ebff1
SHA1 ca1ddef08d47fc15a44a2d651b61e3decce8ebc6
SHA256 6363305dc75b8bf7aa2a8b31b0b0f38022fb0139f809ecba42e5cfe7530830e0
SHA512 1426cd246662adfd9aba4434586dc3bd54d31d395d9fafdcb15e785461a466567bff62e85085c36043cca047f951a96e5fc359c5cbf1000ff3121bba6b2905d0

memory/2696-29-0x0000000000070000-0x00000000000B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe

MD5 0df0a039309525fd27e1b5e056c92b6a
SHA1 7551c27a9123cb56c4218647966a753794ac2961
SHA256 a29379238f93fa6301dd390e635b0c1f53d9197c68adc0f00cbc52bb4311a23f
SHA512 2c00ea216368e254167bd5f2562cbc93953b9c4756765f4504aaae7e9dc45e5584fef1ddb174b651a9a090c7217424e5b80dec58f6f2493c54704f46c35fede6

\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

MD5 c137c5f5287d73a94d55bc18df238303
SHA1 95b4b01775bea14feaaa462c98d969eb81696d2c
SHA256 d294856177658df0159cfe937e5ea95a8ee8a2ca85754d897aea3bb5d0d962c0
SHA512 ba595d185ae98152658ce95964fd6bcce7e970896b0b1c674a142d126cf0433094debcd25527d9b4f5a6568cc5a8a42aeaef536166748eea3973f8b694564aa5

memory/1324-47-0x0000000001040000-0x0000000001228000-memory.dmp

memory/1904-53-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

memory/1904-54-0x0000000002250000-0x0000000002258000-memory.dmp

memory/1324-56-0x0000000005970000-0x0000000005A26000-memory.dmp

memory/2332-66-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2332-68-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2332-67-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2332-65-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2332-63-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2332-61-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2332-59-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2332-57-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1656-74-0x000000001B7A0000-0x000000001BA82000-memory.dmp

memory/1656-75-0x00000000027E0000-0x00000000027E8000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1704-90-0x000000001B500000-0x000000001B7E2000-memory.dmp

memory/1704-91-0x0000000001E90000-0x0000000001E98000-memory.dmp

memory/1952-107-0x0000000002890000-0x0000000002898000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 a64d053e113d59032dfd10ca49e0327e
SHA1 4d63d97acc794b792876831fe8d680ade126bd41
SHA256 9afebd158871c123635ce5b28c2bb7e68418711c5200f47a4e7f5ab09e2fd3b2
SHA512 fe0712512cb15af1a9400fc7e995256d410087c2d7eb8ca75bc1c283076a25c39855d5cb8ae87659b710bee1b08926461a1ec76c3a563662cad5e53ab23e2865

\Users\Admin\AppData\Roaming\svchost.exe

MD5 9af17c8393f0970ee5136bd3ffa27001
SHA1 4b285b72c1a11285a25f31f2597e090da6bbc049
SHA256 71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512 b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

memory/2544-139-0x000000001B680000-0x000000001B962000-memory.dmp

memory/2544-140-0x0000000001F30000-0x0000000001F38000-memory.dmp

memory/2288-146-0x0000000019DE0000-0x000000001A0C2000-memory.dmp

memory/2288-147-0x00000000011D0000-0x00000000011D8000-memory.dmp

memory/1772-153-0x0000000140000000-0x000000014000E000-memory.dmp

memory/1772-151-0x0000000140000000-0x000000014000E000-memory.dmp

memory/1772-150-0x0000000140000000-0x000000014000E000-memory.dmp

memory/1772-149-0x0000000140000000-0x000000014000E000-memory.dmp

memory/1772-148-0x0000000140000000-0x000000014000E000-memory.dmp

memory/1772-155-0x0000000140000000-0x000000014000E000-memory.dmp

memory/848-160-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-157-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-162-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-163-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-161-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-159-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-165-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-169-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-168-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-167-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-166-0x0000000140000000-0x0000000140848000-memory.dmp

memory/848-164-0x0000000000140000-0x0000000000160000-memory.dmp

memory/848-158-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2672-173-0x00000000011B0000-0x00000000011F0000-memory.dmp

memory/848-175-0x0000000140000000-0x0000000140848000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-30 01:18

Reported

2024-06-30 01:21

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe"

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Umbral

stealer umbral

Xworm

trojan rat xworm

xmrig

miner xmrig

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables attemping to enumerate video devices using WMI

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM names

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing possible sandbox system UUIDs

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with unregistered version of .NET Reactor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Creates new service(s)

persistence execution

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe N/A

Stops running service(s)

evasion execution

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk C:\Users\Admin\AppData\Local\Temp\Nursultan.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nursultan Setup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nursultan Setup.exe" C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Запустить Nursultan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Запустить Nursultan.exe" C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nursultan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nursultan.exe" C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4608 set thread context of 744 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 2332 set thread context of 4536 N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe C:\Windows\system32\conhost.exe
PID 2332 set thread context of 4220 N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe C:\Windows\system32\svchost.exe

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\discord-1199748644409184347 C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\discord-1199748644409184347\ = "URL:Run game 1199748644409184347 protocol" C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\discord-1199748644409184347\URL Protocol C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\discord-1199748644409184347\shell\open C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\discord-1199748644409184347\DefaultIcon C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\discord-1199748644409184347\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CrackLauncher.exe" C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\discord-1199748644409184347\shell\open\command C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\discord-1199748644409184347\shell C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\discord-1199748644409184347\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CrackLauncher.exe" C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A
N/A N/A C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1828 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1828 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1828 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe
PID 1828 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe
PID 1828 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1828 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1828 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe
PID 1828 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe
PID 1828 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1828 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1828 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
PID 1828 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
PID 1828 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
PID 3508 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\SYSTEM32\attrib.exe
PID 3508 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\SYSTEM32\attrib.exe
PID 1828 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 1828 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 3508 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\system32\cmd.exe
PID 2040 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\system32\cmd.exe
PID 3508 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4608 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4608 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4608 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4608 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4608 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4608 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4608 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4608 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3508 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 3508 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 3508 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 3508 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 3508 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 3508 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 3508 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3508 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 3508 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\System32\Wbem\wmic.exe
PID 3508 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\SYSTEM32\cmd.exe
PID 3508 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe C:\Windows\SYSTEM32\cmd.exe
PID 744 wrote to memory of 4928 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 4928 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 4928 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 1448 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 2528 wrote to memory of 1448 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 744 wrote to memory of 1868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 1868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 1868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 1944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 1944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 1944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 4272 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 4272 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 4272 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 2300 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\schtasks.exe
PID 744 wrote to memory of 2300 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\schtasks.exe
PID 744 wrote to memory of 2300 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\SysWOW64\schtasks.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe

"C:\Users\Admin\AppData\Local\Temp\87fdd3337325634e35611a0cf9a9a4de31d4630dada6eeea83f261be5fbcaa95.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe'

C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe'

C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe

"C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan.exe'

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe

"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe" && pause

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'

C:\Windows\system32\PING.EXE

ping localhost

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "XMRKNZQC"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "XMRKNZQC" binpath= "C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "XMRKNZQC"

C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe

C:\ProgramData\scppqqgespxv\jqvljmboayxs.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe

svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 mine.bmpool.org udp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 8.8.8.8:53 30.178.252.5.in-addr.arpa udp
RO 5.252.178.30:6004 mine.bmpool.org tcp
N/A 127.0.0.1:28223 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 unknown-sunglasses.gl.at.ply.gg udp
US 147.185.221.20:28223 unknown-sunglasses.gl.at.ply.gg tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 147.185.221.20:28223 unknown-sunglasses.gl.at.ply.gg tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 52.111.227.13:443 tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 147.185.221.20:28223 unknown-sunglasses.gl.at.ply.gg tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
N/A 127.0.0.1:28223 tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 147.185.221.20:28223 unknown-sunglasses.gl.at.ply.gg tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp
RO 5.252.178.30:6004 mine.bmpool.org tcp

Files

memory/1828-0-0x00007FFD407B3000-0x00007FFD407B5000-memory.dmp

memory/1828-1-0x00000000007F0000-0x0000000000AF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4lijxdj.ery.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3628-11-0x000001E3633A0000-0x000001E3633C2000-memory.dmp

memory/3628-12-0x00007FFD407B0000-0x00007FFD41271000-memory.dmp

memory/3628-13-0x00007FFD407B0000-0x00007FFD41271000-memory.dmp

memory/3628-14-0x00007FFD407B0000-0x00007FFD41271000-memory.dmp

memory/3628-17-0x000001E363080000-0x000001E36329C000-memory.dmp

memory/3628-18-0x00007FFD407B0000-0x00007FFD41271000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Nursultan Setup.exe

MD5 a1d8db2a1ff742bc73dd5617083f5fde
SHA1 957b182d82efb40a36099dd886ad581977880838
SHA256 d715e599815190df86069fae7220db64b5999207f77fb6e41cfe318d34c7399a
SHA512 0c5407f5707e5f2808cf1d85d71815ca67d45edc8bd8a83cc424dc927afcbad6ced5a826fff81549e5684ca0ece039513c3351ce7bf231e37885f7ed04dc513f

memory/1828-24-0x00007FFD407B0000-0x00007FFD41271000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Temp\Запустить Nursultan.exe

MD5 f0b33cc162bfd36a995b8c90cd8ebff1
SHA1 ca1ddef08d47fc15a44a2d651b61e3decce8ebc6
SHA256 6363305dc75b8bf7aa2a8b31b0b0f38022fb0139f809ecba42e5cfe7530830e0
SHA512 1426cd246662adfd9aba4434586dc3bd54d31d395d9fafdcb15e785461a466567bff62e85085c36043cca047f951a96e5fc359c5cbf1000ff3121bba6b2905d0

memory/3508-51-0x000002B1E0AC0000-0x000002B1E0B00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 da5c82b0e070047f7377042d08093ff4
SHA1 89d05987cd60828cca516c5c40c18935c35e8bd3
SHA256 77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5
SHA512 7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe

MD5 0df0a039309525fd27e1b5e056c92b6a
SHA1 7551c27a9123cb56c4218647966a753794ac2961
SHA256 a29379238f93fa6301dd390e635b0c1f53d9197c68adc0f00cbc52bb4311a23f
SHA512 2c00ea216368e254167bd5f2562cbc93953b9c4756765f4504aaae7e9dc45e5584fef1ddb174b651a9a090c7217424e5b80dec58f6f2493c54704f46c35fede6

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

MD5 c137c5f5287d73a94d55bc18df238303
SHA1 95b4b01775bea14feaaa462c98d969eb81696d2c
SHA256 d294856177658df0159cfe937e5ea95a8ee8a2ca85754d897aea3bb5d0d962c0
SHA512 ba595d185ae98152658ce95964fd6bcce7e970896b0b1c674a142d126cf0433094debcd25527d9b4f5a6568cc5a8a42aeaef536166748eea3973f8b694564aa5

memory/4608-82-0x0000000000AF0000-0x0000000000CD8000-memory.dmp

memory/1828-83-0x00007FFD407B0000-0x00007FFD41271000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4fc1ceefa94c82f73b7ee478e2920ea3
SHA1 17a031c8d10e316478d85d24ba8a8b5ebfda3149
SHA256 018553e7801fd476285775a4df59eb6a6c79774f6253d6dcbe9e4e96de3c96fb
SHA512 cd581f4b96e1eff3e1c8e75e9e67050060f9bdc92c2a4a0ca8282b4b1839fde9f7848cc262b8ef189466bdd51c0940be7392ae7f0278b2113d10ed590d11b311

memory/4608-95-0x0000000005770000-0x000000000580C000-memory.dmp

memory/4608-97-0x00000000064B0000-0x0000000006A54000-memory.dmp

memory/4608-99-0x0000000005F80000-0x0000000006036000-memory.dmp

memory/744-109-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d8cb3e9459807e35f02130fad3f9860d
SHA1 5af7f32cb8a30e850892b15e9164030a041f4bd6
SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
SHA512 045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

memory/3508-115-0x000002B1FB240000-0x000002B1FB2B6000-memory.dmp

memory/3508-116-0x000002B1FB2C0000-0x000002B1FB310000-memory.dmp

memory/3508-117-0x000002B1FB1E0000-0x000002B1FB1FE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c9b6705519e1eef08f86c4ba5f4286f3
SHA1 6c6b179e452ecee2673a1d4fe128f1c06f70577f
SHA256 0f9cad44a79126871580e19b01dc3f880c5173b1faaf8b9018d5d1f829714705
SHA512 6d8f85a7a8b0b124530f36a157cd0441b5c1eacdc35e274af9fbf0569d03d1d5e468651a5b2425f0215c282ecfa7b1ffeaeeaf18612822f00bd14306d30640c7

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 88be3bc8a7f90e3953298c0fdbec4d72
SHA1 f4969784ad421cc80ef45608727aacd0f6bf2e4b
SHA256 533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
SHA512 4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

memory/3508-154-0x000002B1E2830000-0x000002B1E283A000-memory.dmp

memory/3508-155-0x000002B1FB200000-0x000002B1FB212000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 adb2d5e1a5595365546f2bcd774a5be5
SHA1 b15ab5a08855b1b630197471d7ca7f81df9b8d3e
SHA256 47ea8cc898d4c287d4bbf125ac8f8247e76c9b99e266e4b351948dd0ae05683a
SHA512 fdaa080e169569298012a97de1897e5369aa04650b6c0c29570c88007f7b3d85653dfa86efdc9943c74d37c392fb46c6afc629d31172f4c692539e32d99a1372

memory/4928-175-0x0000000002A30000-0x0000000002A66000-memory.dmp

memory/4928-176-0x0000000005610000-0x0000000005C38000-memory.dmp

memory/4928-177-0x00000000054A0000-0x00000000054C2000-memory.dmp

memory/4928-178-0x0000000005CB0000-0x0000000005D16000-memory.dmp

memory/4928-179-0x0000000005D20000-0x0000000005D86000-memory.dmp

memory/4928-189-0x0000000005D90000-0x00000000060E4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8a424e81b5a6078deff05e153c04a0ee
SHA1 bf209de0dbc1dbe7c5b5b511bd34bf447a3c049b
SHA256 79ce6d6caea4a9eabf8fdbb2a1c58d43fb5a3c500c2dec3fce87c160d2c6bda3
SHA512 aa01195e5c1d641304b08fed4a3bffc916972aa0bc20e928204cef1783f38922a03b761cf2010ccbace1ea0d2f18cda4eaeee4d8969f32fbae5f580e4e38522d

memory/4928-191-0x0000000006350000-0x000000000636E000-memory.dmp

memory/4928-192-0x0000000006390000-0x00000000063DC000-memory.dmp

memory/4928-193-0x0000000006940000-0x0000000006972000-memory.dmp

memory/4928-194-0x00000000705A0000-0x00000000705EC000-memory.dmp

memory/4928-204-0x0000000006980000-0x000000000699E000-memory.dmp

memory/4928-205-0x0000000007580000-0x0000000007623000-memory.dmp

memory/4928-206-0x0000000007CC0000-0x000000000833A000-memory.dmp

memory/4928-207-0x0000000007680000-0x000000000769A000-memory.dmp

memory/4928-208-0x00000000076E0000-0x00000000076EA000-memory.dmp

memory/4928-209-0x0000000007910000-0x00000000079A6000-memory.dmp

memory/4928-210-0x0000000007880000-0x0000000007891000-memory.dmp

memory/4928-211-0x00000000078B0000-0x00000000078BE000-memory.dmp

memory/4928-212-0x00000000078C0000-0x00000000078D4000-memory.dmp

memory/4928-213-0x00000000079D0000-0x00000000079EA000-memory.dmp

memory/4928-214-0x0000000007900000-0x0000000007908000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/1868-227-0x00000000061B0000-0x0000000006504000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ae9c6a04d93b4c896b37c718a3376bd9
SHA1 d2908ec0f67e6753e6e6e5c3cf8f4e0dedd078b4
SHA256 336394bc1f7d705a6c448d73afa81feb506a73124fcc3d1a66c106278cc6a5c6
SHA512 1936beb5cfcee3f92e7eb07abc1f81de45aa2b331e8dbbc10bb7120730a95ee3433de3136ffb9a1f5306c8af002af1a593d38acba375e5eb31129a48b14e1aa2

memory/1868-229-0x00000000705A0000-0x00000000705EC000-memory.dmp

memory/1944-240-0x0000000005E60000-0x00000000061B4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6ee93dad6026cd1d46e7c3c0f088eff9
SHA1 e9785ea3ca178050bf2f4f875702925b611c6ab3
SHA256 74cbc653b8c0f61b5ca03ebf4e77f73b885c81f5bea04dc671c3bdc750754b14
SHA512 8c41951e699ae2fb700fdb32fb3166310cf63c090274e5151f40db5ea0b1f3b2487d0d4f58d4cc90b8ef1b030bae687858d73d66107dac7a625f880037c634d8

memory/1944-251-0x00000000705A0000-0x00000000705EC000-memory.dmp

memory/4272-271-0x0000000005D50000-0x00000000060A4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 69c616e3f57e1e1483a9af58346a75d8
SHA1 1a1954de5f69c99a37f819f5a5430cd52afaecf0
SHA256 529b7a6ee3ca4a565b1693b225dfddf3d23d7dfe9d0ad7f121e877cf14166e0c
SHA512 b2e84185eebb613c0fddb0a4de3658ad9d441f1f63dc2dece1035e44c51dd218144b288e016e4334683c26d24f45dcd39f7cdc74ae2b3760612fcdbfd04d37bb

memory/4272-273-0x00000000705A0000-0x00000000705EC000-memory.dmp

memory/744-288-0x0000000006990000-0x0000000006A22000-memory.dmp

memory/744-289-0x0000000006280000-0x000000000628A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 31bfccb189f1cc148776a3a0a7852f86
SHA1 ceafe741dc1476fb1c6c7b40006979ed8d53d4af
SHA256 c95ed201b69c47ac163bc763259e1e69a2a3f18e529cac6e493594f609c836b3
SHA512 2773f6d7fd6dfa26520522f7aafb5f6f7c3a9d16ed812a0951d679cd2e9dc726600b557f53a5e42c2178e14bb9434bc1d862d4444ff0875a6d016401a404ce0e

memory/2144-322-0x0000017A2E910000-0x0000017A2E92C000-memory.dmp

memory/2144-323-0x0000017A2E930000-0x0000017A2E9E5000-memory.dmp

memory/2144-324-0x0000017A2E6B0000-0x0000017A2E6BA000-memory.dmp

memory/2144-325-0x0000017A2EB50000-0x0000017A2EB6C000-memory.dmp

memory/2144-326-0x0000017A2E6C0000-0x0000017A2E6CA000-memory.dmp

memory/2144-327-0x0000017A2EB70000-0x0000017A2EB8A000-memory.dmp

memory/2144-328-0x0000017A2EB30000-0x0000017A2EB38000-memory.dmp

memory/2144-329-0x0000017A2EB40000-0x0000017A2EB46000-memory.dmp

memory/2144-330-0x0000017A2EB90000-0x0000017A2EB9A000-memory.dmp

memory/4536-337-0x0000000140000000-0x000000014000E000-memory.dmp

memory/4536-340-0x0000000140000000-0x000000014000E000-memory.dmp

memory/4220-341-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4220-346-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4220-350-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4220-352-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4220-351-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4220-349-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4220-348-0x000001D852340000-0x000001D852360000-memory.dmp

memory/4220-347-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4220-345-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4220-343-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4220-344-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4220-342-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4536-336-0x0000000140000000-0x000000014000E000-memory.dmp

memory/4536-335-0x0000000140000000-0x000000014000E000-memory.dmp

memory/4536-334-0x0000000140000000-0x000000014000E000-memory.dmp

memory/4536-333-0x0000000140000000-0x000000014000E000-memory.dmp

memory/4220-353-0x0000000140000000-0x0000000140848000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

memory/2408-356-0x00000000009C0000-0x0000000000A00000-memory.dmp

memory/2408-357-0x00000000056D0000-0x00000000056EA000-memory.dmp

memory/2408-358-0x0000000005B60000-0x0000000005CBA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log

MD5 0efd0cfcc86075d96e951890baf0fa87
SHA1 6e98c66d43aa3f01b2395048e754d69b7386b511
SHA256 ff981780f37479af6a428dd121eef68cf6e0b471ae92f080893a55320cc993f7
SHA512 4e79f5a8494aac94f98af8dbbc71bdd0a57b02103757ad970da7e7d4e6a0dc5015ca008256a6bd2c5bdec3a0f5736a994e17b3ef004b0f374a3339e480ac41b1

memory/4220-363-0x0000000140000000-0x0000000140848000-memory.dmp