Analysis
-
max time kernel
31s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2024 08:46
Static task
static1
General
-
Target
Elixir Injector.exe
-
Size
1.9MB
-
MD5
04095b54d4245dca4aeb05310a2ddc8a
-
SHA1
4d5bc54fade2e8af35d36ae0cab2c0f835cb7334
-
SHA256
7014e9a725d8449f588d906d671771ccbf2c253d603205818a5af782a02e320c
-
SHA512
f666c5f973a67aeb3d56b2055884267f2fd892634c2267dbd0e29965285dc05d876658fa944100bafe572b66061a8a7caefd3b1e650ee9302ae229255a8a854f
-
SSDEEP
49152:OB8cSz7LU1B6RIML97yovHGfx8UINTPWUznpd:QEvKB6WMBvqnIJx
Malware Config
Extracted
gurcu
https://api.telegram.org/bot7622199935:AAFHSUQ61526mhYJcmipjqz2DM9Zso04aBI/sendPhot
Signatures
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 392 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4888 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3692 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3104 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2568 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4652 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3704 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2852 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 400 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2944 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4508 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2884 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 512 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1636 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4936 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2196 1492 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1772 1492 schtasks.exe 91 -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3900 powershell.exe 1348 powershell.exe 2292 powershell.exe 4452 powershell.exe 2648 powershell.exe 4848 powershell.exe 3568 powershell.exe 4128 powershell.exe 3008 powershell.exe 4564 powershell.exe 4024 powershell.exe 4548 powershell.exe 2460 powershell.exe 1948 powershell.exe 3700 powershell.exe 4252 powershell.exe 1744 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Elixir Injector.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Bluestacks.exe -
Executes dropped EXE 2 IoCs
pid Process 4152 Bluestacks.exe 6096 cmd.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ipinfo.io 13 ipinfo.io -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe Bluestacks.exe File created C:\Windows\SysWOW64\sr-Latn-RS\ee2ad38f3d4382 Bluestacks.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsPowerShell\Modules\backgroundTaskHost.exe Bluestacks.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\backgroundTaskHost.exe Bluestacks.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\eddb19405b7ce1 Bluestacks.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\cmd.exe Bluestacks.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\ebf1f9fa8afd6d Bluestacks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elixir Injector.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5828 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Elixir Injector.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Bluestacks.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 6056 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5828 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2852 schtasks.exe 400 schtasks.exe 2944 schtasks.exe 4508 schtasks.exe 392 schtasks.exe 4888 schtasks.exe 3104 schtasks.exe 4652 schtasks.exe 512 schtasks.exe 4936 schtasks.exe 2196 schtasks.exe 1772 schtasks.exe 1728 schtasks.exe 2568 schtasks.exe 3704 schtasks.exe 1636 schtasks.exe 3692 schtasks.exe 2884 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe 4152 Bluestacks.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 4152 Bluestacks.exe Token: SeDebugPrivilege 4260 taskmgr.exe Token: SeSystemProfilePrivilege 4260 taskmgr.exe Token: SeCreateGlobalPrivilege 4260 taskmgr.exe Token: SeDebugPrivilege 4548 powershell.exe Token: SeDebugPrivilege 2292 powershell.exe Token: SeDebugPrivilege 4252 powershell.exe Token: SeDebugPrivilege 3008 powershell.exe Token: SeDebugPrivilege 4128 powershell.exe Token: SeDebugPrivilege 4848 powershell.exe Token: SeDebugPrivilege 3900 powershell.exe Token: SeDebugPrivilege 3568 powershell.exe Token: SeDebugPrivilege 3700 powershell.exe Token: 33 4260 taskmgr.exe Token: SeIncBasePriorityPrivilege 4260 taskmgr.exe Token: SeDebugPrivilege 1948 powershell.exe Token: SeDebugPrivilege 1348 powershell.exe Token: SeDebugPrivilege 2460 powershell.exe Token: SeDebugPrivilege 4564 powershell.exe Token: SeDebugPrivilege 1744 powershell.exe Token: SeDebugPrivilege 2648 powershell.exe Token: SeDebugPrivilege 4024 powershell.exe Token: SeDebugPrivilege 4452 powershell.exe Token: SeDebugPrivilege 6096 cmd.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4540 2356 Elixir Injector.exe 86 PID 2356 wrote to memory of 4540 2356 Elixir Injector.exe 86 PID 2356 wrote to memory of 4540 2356 Elixir Injector.exe 86 PID 4540 wrote to memory of 4916 4540 WScript.exe 88 PID 4540 wrote to memory of 4916 4540 WScript.exe 88 PID 4540 wrote to memory of 4916 4540 WScript.exe 88 PID 4916 wrote to memory of 4152 4916 cmd.exe 90 PID 4916 wrote to memory of 4152 4916 cmd.exe 90 PID 4152 wrote to memory of 4452 4152 Bluestacks.exe 111 PID 4152 wrote to memory of 4452 4152 Bluestacks.exe 111 PID 4152 wrote to memory of 4128 4152 Bluestacks.exe 112 PID 4152 wrote to memory of 4128 4152 Bluestacks.exe 112 PID 4152 wrote to memory of 3568 4152 Bluestacks.exe 113 PID 4152 wrote to memory of 3568 4152 Bluestacks.exe 113 PID 4152 wrote to memory of 4848 4152 Bluestacks.exe 114 PID 4152 wrote to memory of 4848 4152 Bluestacks.exe 114 PID 4152 wrote to memory of 2292 4152 Bluestacks.exe 115 PID 4152 wrote to memory of 2292 4152 Bluestacks.exe 115 PID 4152 wrote to memory of 1744 4152 Bluestacks.exe 116 PID 4152 wrote to memory of 1744 4152 Bluestacks.exe 116 PID 4152 wrote to memory of 4564 4152 Bluestacks.exe 117 PID 4152 wrote to memory of 4564 4152 Bluestacks.exe 117 PID 4152 wrote to memory of 1948 4152 Bluestacks.exe 118 PID 4152 wrote to memory of 1948 4152 Bluestacks.exe 118 PID 4152 wrote to memory of 1348 4152 Bluestacks.exe 119 PID 4152 wrote to memory of 1348 4152 Bluestacks.exe 119 PID 4152 wrote to memory of 4252 4152 Bluestacks.exe 120 PID 4152 wrote to memory of 4252 4152 Bluestacks.exe 120 PID 4152 wrote to memory of 2460 4152 Bluestacks.exe 121 PID 4152 wrote to memory of 2460 4152 Bluestacks.exe 121 PID 4152 wrote to memory of 3900 4152 Bluestacks.exe 122 PID 4152 wrote to memory of 3900 4152 Bluestacks.exe 122 PID 4152 wrote to memory of 4548 4152 Bluestacks.exe 123 PID 4152 wrote to memory of 4548 4152 Bluestacks.exe 123 PID 4152 wrote to memory of 2648 4152 Bluestacks.exe 124 PID 4152 wrote to memory of 2648 4152 Bluestacks.exe 124 PID 4152 wrote to memory of 3700 4152 Bluestacks.exe 125 PID 4152 wrote to memory of 3700 4152 Bluestacks.exe 125 PID 4152 wrote to memory of 4024 4152 Bluestacks.exe 126 PID 4152 wrote to memory of 4024 4152 Bluestacks.exe 126 PID 4152 wrote to memory of 3008 4152 Bluestacks.exe 127 PID 4152 wrote to memory of 3008 4152 Bluestacks.exe 127 PID 4152 wrote to memory of 392 4152 Bluestacks.exe 145 PID 4152 wrote to memory of 392 4152 Bluestacks.exe 145 PID 392 wrote to memory of 5352 392 cmd.exe 147 PID 392 wrote to memory of 5352 392 cmd.exe 147 PID 392 wrote to memory of 5828 392 cmd.exe 149 PID 392 wrote to memory of 5828 392 cmd.exe 149 PID 392 wrote to memory of 6096 392 cmd.exe 151 PID 392 wrote to memory of 6096 392 cmd.exe 151 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Elixir Injector.exe"C:\Users\Admin\AppData\Local\Temp\Elixir Injector.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WinRAR\data\bin\unistall\6iq5IFzZA9EyHTwKHM8vXk9USXtHecApoG.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe"C:\Users\Admin\AppData\Local\Temp\WinRAR/data/bin/unistall/Bluestacks.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Recent\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\backgroundTaskHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FAvcGeI3ml.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\system32\chcp.comchcp 650016⤵PID:5352
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5828
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\cmd.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\cmd.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6096
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Recent\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Admin\Recent\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Recent\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Default\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "BluestacksB" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Bluestacks" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "BluestacksB" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log1⤵
- Opens file in notepad (likely ransom note)
PID:6056
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6116
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5101c3b86ef1c02c62b7d862c2a47363b
SHA13c5e8d309610e5ba41b6b9788bfb826e45864b46
SHA2569174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c
SHA512d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD528d4235aa2e6d782751f980ceb6e5021
SHA1f5d82d56acd642b9fc4b963f684fd6b78f25a140
SHA2568c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
SHA512dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
182B
MD58bf4962f79fa014a084ddd48c62f968a
SHA1d5e0eeb3ed3595d30e2e59cf0a38c4bb7d237ad8
SHA2562a31bc00761b455c1015faca3bf964fc4a902d5724ae60bf06b7ef6468f94f0a
SHA5120fc0de30399508adf36533e6bb32bce980cadf0594bc3baf559e6627410a270d18cc4fc5367a7965928bc5752927393cb85519caef3d49d0c0b4518c6c9556c6
-
Filesize
95B
MD5aa898d60b0bc1941439402668a8a16b3
SHA19574950945fc837fe9ff07ee3ca6c32185842e0e
SHA256046bfe53d5f3e0658d97eeada7719219544da9cf16508a1e85b0bfe7831388a8
SHA5125964f3294d9a7e8ccbe4d8c2c5fd66edc5ad28bd4b5c9664c67ff74f85852ae7d3fa45f42862821f91e94f4ce03c248a858b0e8a4026ef66cdce72c96159a2ff
-
C:\Users\Admin\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe
Filesize240B
MD586d5fa5e3228e9586230609c34cdeec7
SHA11e27f4cf478a2bb3a99491476e74c7968b811eed
SHA256a68460a1a574480ffa92d8d4fbe8636d5a32cc3da84936bcb3b47d829a7e588d
SHA512d4b15b180ab9887f0547193cd42f7273c82bf53f228df74f64424ed684342bc7717669f909a7a156cc0e37a6415a12fddeb7d27c9cc12058d93ce64e2345bc79
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82