Analysis
-
max time kernel
895s -
max time network
904s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
06/03/2025, 18:11
General
-
Target
15415145.exe
-
Size
59KB
-
MD5
6c091ad6fae0fa76f44870d1a1b05cb4
-
SHA1
040f60c0ee3f4902f919025057e34ab4d11b1abd
-
SHA256
c352c942b6df33510094c7100fb9d48e36b8e1e2af40a60ccc360b58721c2390
-
SHA512
3a414f40f99e5847d9631c4ac1143c76e77db7ae42dd8c7aed2ebf1742ec73bb802d54d6cbde3b04f6b894a4cf731aa4e9dbad95166bade13f787b489d8e8d86
-
SSDEEP
1536:skyZtyUQ8sBkROLW+UzbTH3gfm2qt0OgSko7:skItfQ8sBkROUzbTQf+6OgK7
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
known-savage.gl.at.ply.gg:45116
association-lectures.gl.at.ply.gg:32463
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
aes.plain
Signatures
-
Detect Xworm Payload 64 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops startup file 22 IoCs
-
Executes dropped EXE 64 IoCs
-
Adds Run key to start application 2 TTPs 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\15415145.exe"C:\Users\Admin\AppData\Local\Temp\15415145.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "15415145" /tr "C:\Users\Admin\AppData\Roaming\15415145.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\jjwdsk.exe"C:\Users\Admin\AppData\Local\Temp\jjwdsk.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\jjwdsk.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'jjwdsk.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\jjwdsk.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "jjwdsk" /tr "C:\Users\Admin\AppData\Roaming\jjwdsk.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\fdmpfc.exe"C:\Users\Admin\AppData\Local\Temp\fdmpfc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\zztbcq.exe"C:\Users\Admin\AppData\Local\Temp\zztbcq.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\luvtlv.exe"C:\Users\Admin\AppData\Local\Temp\luvtlv.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "luvtlv" /tr "C:\Users\Admin\AppData\Roaming\luvtlv.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\ppfbjd.exe"C:\Users\Admin\AppData\Local\Temp\ppfbjd.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\bordcc.exe"C:\Users\Admin\AppData\Local\Temp\bordcc.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\iiyhsz.exe"C:\Users\Admin\AppData\Local\Temp\iiyhsz.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\atiemw.exe"C:\Users\Admin\AppData\Local\Temp\atiemw.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "atiemw" /tr "C:\Users\Admin\AppData\Roaming\atiemw.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\eqkfzw.exe"C:\Users\Admin\AppData\Local\Temp\eqkfzw.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\treruo.exe"C:\Users\Admin\AppData\Local\Temp\treruo.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\xqrgsd.exe"C:\Users\Admin\AppData\Local\Temp\xqrgsd.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\cjyytx.exe"C:\Users\Admin\AppData\Local\Temp\cjyytx.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\txkcun.exe"C:\Users\Admin\AppData\Local\Temp\txkcun.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tzirxw.exe"C:\Users\Admin\AppData\Local\Temp\tzirxw.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wuklof.exe"C:\Users\Admin\AppData\Local\Temp\wuklof.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\yurkrl.exe"C:\Users\Admin\AppData\Local\Temp\yurkrl.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fcmnoy.exe"C:\Users\Admin\AppData\Local\Temp\fcmnoy.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ggxnlc.exe"C:\Users\Admin\AppData\Local\Temp\ggxnlc.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mqwryu.exe"C:\Users\Admin\AppData\Local\Temp\mqwryu.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ffsujx.exe"C:\Users\Admin\AppData\Local\Temp\ffsujx.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\trutzy.exe"C:\Users\Admin\AppData\Local\Temp\trutzy.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gjfyxs.exe"C:\Users\Admin\AppData\Local\Temp\gjfyxs.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\afkjkr.exe"C:\Users\Admin\AppData\Local\Temp\afkjkr.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zjihyx.exe"C:\Users\Admin\AppData\Local\Temp\zjihyx.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ihwwem.exe"C:\Users\Admin\AppData\Local\Temp\ihwwem.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sksoux.exe"C:\Users\Admin\AppData\Local\Temp\sksoux.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dngygc.exe"C:\Users\Admin\AppData\Local\Temp\dngygc.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xnteqs.exe"C:\Users\Admin\AppData\Local\Temp\xnteqs.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jwvbua.exe"C:\Users\Admin\AppData\Local\Temp\jwvbua.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\plsxls.exe"C:\Users\Admin\AppData\Local\Temp\plsxls.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cjftfm.exe"C:\Users\Admin\AppData\Local\Temp\cjftfm.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zmlngx.exe"C:\Users\Admin\AppData\Local\Temp\zmlngx.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kacgjl.exe"C:\Users\Admin\AppData\Local\Temp\kacgjl.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\edqdmh.exe"C:\Users\Admin\AppData\Local\Temp\edqdmh.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qrqszi.exe"C:\Users\Admin\AppData\Local\Temp\qrqszi.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\egbowx.exe"C:\Users\Admin\AppData\Local\Temp\egbowx.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\dbacem.exe"C:\Users\Admin\AppData\Local\Temp\dbacem.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\rqqrun.exe"C:\Users\Admin\AppData\Local\Temp\rqqrun.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\pyopnm.exe"C:\Users\Admin\AppData\Local\Temp\pyopnm.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "pyopnm" /tr "C:\Users\Admin\AppData\Roaming\pyopnm.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\vmbmiw.exe"C:\Users\Admin\AppData\Local\Temp\vmbmiw.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\jloljn.exe"C:\Users\Admin\AppData\Local\Temp\jloljn.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\rvhuzj.exe"C:\Users\Admin\AppData\Local\Temp\rvhuzj.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\zmsacb.exe"C:\Users\Admin\AppData\Local\Temp\zmsacb.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sozazr.exe"C:\Users\Admin\AppData\Local\Temp\sozazr.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qnpxku.exe"C:\Users\Admin\AppData\Local\Temp\qnpxku.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kcerww.exe"C:\Users\Admin\AppData\Local\Temp\kcerww.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ihpuzh.exe"C:\Users\Admin\AppData\Local\Temp\ihpuzh.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zmgeir.exe"C:\Users\Admin\AppData\Local\Temp\zmgeir.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tvjatu.exe"C:\Users\Admin\AppData\Local\Temp\tvjatu.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wimxvw.exe"C:\Users\Admin\AppData\Local\Temp\wimxvw.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\yulnjw.exe"C:\Users\Admin\AppData\Local\Temp\yulnjw.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ehqvsu.exe"C:\Users\Admin\AppData\Local\Temp\ehqvsu.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lypsbm.exe"C:\Users\Admin\AppData\Local\Temp\lypsbm.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\klfxdp.exe"C:\Users\Admin\AppData\Local\Temp\klfxdp.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kkikvn.exe"C:\Users\Admin\AppData\Local\Temp\kkikvn.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jkmtwf.exe"C:\Users\Admin\AppData\Local\Temp\jkmtwf.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wldjza.exe"C:\Users\Admin\AppData\Local\Temp\wldjza.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bycpov.exe"C:\Users\Admin\AppData\Local\Temp\bycpov.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fehamj.exe"C:\Users\Admin\AppData\Local\Temp\fehamj.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\raqvcz.exe"C:\Users\Admin\AppData\Local\Temp\raqvcz.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oumcmh.exe"C:\Users\Admin\AppData\Local\Temp\oumcmh.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\irbjvp.exe"C:\Users\Admin\AppData\Local\Temp\irbjvp.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jblevf.exe"C:\Users\Admin\AppData\Local\Temp\jblevf.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mvvmfq.exe"C:\Users\Admin\AppData\Local\Temp\mvvmfq.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fjyccv.exe"C:\Users\Admin\AppData\Local\Temp\fjyccv.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\givuzj.exe"C:\Users\Admin\AppData\Local\Temp\givuzj.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\fdkovh.exe"C:\Users\Admin\AppData\Local\Temp\fdkovh.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "fdkovh" /tr "C:\Users\Admin\AppData\Roaming\fdkovh.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\eiiisv.exe"C:\Users\Admin\AppData\Local\Temp\eiiisv.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\twrfdf.exe"C:\Users\Admin\AppData\Local\Temp\twrfdf.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xqnwdt.exe"C:\Users\Admin\AppData\Local\Temp\xqnwdt.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bkbpaj.exe"C:\Users\Admin\AppData\Local\Temp\bkbpaj.exe"4⤵
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bkbpaj" /tr "C:\Users\Admin\AppData\Roaming\bkbpaj.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\dexlag.exe"C:\Users\Admin\AppData\Local\Temp\dexlag.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\uysvkn.exe"C:\Users\Admin\AppData\Local\Temp\uysvkn.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iashor.exe"C:\Users\Admin\AppData\Local\Temp\iashor.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dqazxf.exe"C:\Users\Admin\AppData\Local\Temp\dqazxf.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sxexaw.exe"C:\Users\Admin\AppData\Local\Temp\sxexaw.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bhlyep.exe"C:\Users\Admin\AppData\Local\Temp\bhlyep.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hdnlsc.exe"C:\Users\Admin\AppData\Local\Temp\hdnlsc.exe"5⤵
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "hdnlsc" /tr "C:\Users\Admin\AppData\Roaming\hdnlsc.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\dzcmon.exe"C:\Users\Admin\AppData\Local\Temp\dzcmon.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ccclme.exe"C:\Users\Admin\AppData\Local\Temp\ccclme.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mayatk.exe"C:\Users\Admin\AppData\Local\Temp\mayatk.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jnjzor.exe"C:\Users\Admin\AppData\Local\Temp\jnjzor.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zmjaro.exe"C:\Users\Admin\AppData\Local\Temp\zmjaro.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tsyxdm.exe"C:\Users\Admin\AppData\Local\Temp\tsyxdm.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\reungr.exe"C:\Users\Admin\AppData\Local\Temp\reungr.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lixgwj.exe"C:\Users\Admin\AppData\Local\Temp\lixgwj.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ymjqwq.exe"C:\Users\Admin\AppData\Local\Temp\ymjqwq.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wvixlc.exe"C:\Users\Admin\AppData\Local\Temp\wvixlc.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lhlnna.exe"C:\Users\Admin\AppData\Local\Temp\lhlnna.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bdgstc.exe"C:\Users\Admin\AppData\Local\Temp\bdgstc.exe"5⤵
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bdgstc" /tr "C:\Users\Admin\AppData\Roaming\bdgstc.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\rproak.exe"C:\Users\Admin\AppData\Local\Temp\rproak.exe"6⤵
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "rproak" /tr "C:\Users\Admin\AppData\Roaming\rproak.exe"7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\vqxrlf.exe"C:\Users\Admin\AppData\Local\Temp\vqxrlf.exe"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\meybia.exe"C:\Users\Admin\AppData\Local\Temp\meybia.exe"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\aymddv.exe"C:\Users\Admin\AppData\Local\Temp\aymddv.exe"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gpgpxm.exe"C:\Users\Admin\AppData\Local\Temp\gpgpxm.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\uyjnxq.exe"C:\Users\Admin\AppData\Local\Temp\uyjnxq.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cemerp.exe"C:\Users\Admin\AppData\Local\Temp\cemerp.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dazago.exe"C:\Users\Admin\AppData\Local\Temp\dazago.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oajang.exe"C:\Users\Admin\AppData\Local\Temp\oajang.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\knbrvf.exe"C:\Users\Admin\AppData\Local\Temp\knbrvf.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\bwxvud.exe"C:\Users\Admin\AppData\Local\Temp\bwxvud.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cjwdak.exe"C:\Users\Admin\AppData\Local\Temp\cjwdak.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\esxxcb.exe"C:\Users\Admin\AppData\Local\Temp\esxxcb.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wumcmt.exe"C:\Users\Admin\AppData\Local\Temp\wumcmt.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lnukxa.exe"C:\Users\Admin\AppData\Local\Temp\lnukxa.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jokkjv.exe"C:\Users\Admin\AppData\Local\Temp\jokkjv.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fbbfvb.exe"C:\Users\Admin\AppData\Local\Temp\fbbfvb.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fihbju.exe"C:\Users\Admin\AppData\Local\Temp\fihbju.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\nvwtnk.exe"C:\Users\Admin\AppData\Local\Temp\nvwtnk.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xadkxq.exe"C:\Users\Admin\AppData\Local\Temp\xadkxq.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\uctphl.exe"C:\Users\Admin\AppData\Local\Temp\uctphl.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\niyqpi.exe"C:\Users\Admin\AppData\Local\Temp\niyqpi.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iwmcpq.exe"C:\Users\Admin\AppData\Local\Temp\iwmcpq.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cphzvx.exe"C:\Users\Admin\AppData\Local\Temp\cphzvx.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zzjhhc.exe"C:\Users\Admin\AppData\Local\Temp\zzjhhc.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cmtwbb.exe"C:\Users\Admin\AppData\Local\Temp\cmtwbb.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\amcpcs.exe"C:\Users\Admin\AppData\Local\Temp\amcpcs.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lwfnlr.exe"C:\Users\Admin\AppData\Local\Temp\lwfnlr.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\yulmih.exe"C:\Users\Admin\AppData\Local\Temp\yulmih.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ivhwqi.exe"C:\Users\Admin\AppData\Local\Temp\ivhwqi.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cfavoc.exe"C:\Users\Admin\AppData\Local\Temp\cfavoc.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\plulcc.exe"C:\Users\Admin\AppData\Local\Temp\plulcc.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nmnpny.exe"C:\Users\Admin\AppData\Local\Temp\nmnpny.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rlorjn.exe"C:\Users\Admin\AppData\Local\Temp\rlorjn.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qpelnf.exe"C:\Users\Admin\AppData\Local\Temp\qpelnf.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tdwunw.exe"C:\Users\Admin\AppData\Local\Temp\tdwunw.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rpidyz.exe"C:\Users\Admin\AppData\Local\Temp\rpidyz.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xnsizw.exe"C:\Users\Admin\AppData\Local\Temp\xnsizw.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\akdixi.exe"C:\Users\Admin\AppData\Local\Temp\akdixi.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\cyjeml.exe"C:\Users\Admin\AppData\Local\Temp\cyjeml.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\lqokru.exe"C:\Users\Admin\AppData\Local\Temp\lqokru.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kkgwyd.exe"C:\Users\Admin\AppData\Local\Temp\kkgwyd.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bicqxb.exe"C:\Users\Admin\AppData\Local\Temp\bicqxb.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bcviqj.exe"C:\Users\Admin\AppData\Local\Temp\bcviqj.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jhagmp.exe"C:\Users\Admin\AppData\Local\Temp\jhagmp.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cbvkji.exe"C:\Users\Admin\AppData\Local\Temp\cbvkji.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vulqdk.exe"C:\Users\Admin\AppData\Local\Temp\vulqdk.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bemzhp.exe"C:\Users\Admin\AppData\Local\Temp\bemzhp.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gmaidj.exe"C:\Users\Admin\AppData\Local\Temp\gmaidj.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pcaebk.exe"C:\Users\Admin\AppData\Local\Temp\pcaebk.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\texrtw.exe"C:\Users\Admin\AppData\Local\Temp\texrtw.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hqztvc.exe"C:\Users\Admin\AppData\Local\Temp\hqztvc.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qlykhl.exe"C:\Users\Admin\AppData\Local\Temp\qlykhl.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wkalaa.exe"C:\Users\Admin\AppData\Local\Temp\wkalaa.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ouymug.exe"C:\Users\Admin\AppData\Local\Temp\ouymug.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iqtbxz.exe"C:\Users\Admin\AppData\Local\Temp\iqtbxz.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nklqrq.exe"C:\Users\Admin\AppData\Local\Temp\nklqrq.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pmqxrr.exe"C:\Users\Admin\AppData\Local\Temp\pmqxrr.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kevoiq.exe"C:\Users\Admin\AppData\Local\Temp\kevoiq.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jhdwcy.exe"C:\Users\Admin\AppData\Local\Temp\jhdwcy.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xvwtle.exe"C:\Users\Admin\AppData\Local\Temp\xvwtle.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\joozxx.exe"C:\Users\Admin\AppData\Local\Temp\joozxx.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\agskvn.exe"C:\Users\Admin\AppData\Local\Temp\agskvn.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\phuecx.exe"C:\Users\Admin\AppData\Local\Temp\phuecx.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\lauoru.exe"C:\Users\Admin\AppData\Local\Temp\lauoru.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\oceery.exe"C:\Users\Admin\AppData\Local\Temp\oceery.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\ngnswb.exe"C:\Users\Admin\AppData\Local\Temp\ngnswb.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\gggcnp.exe"C:\Users\Admin\AppData\Local\Temp\gggcnp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\jqxbnl.exe"C:\Users\Admin\AppData\Local\Temp\jqxbnl.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\qaboee.exe"C:\Users\Admin\AppData\Local\Temp\qaboee.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\hkhyna.exe"C:\Users\Admin\AppData\Local\Temp\hkhyna.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\mgcwgf.exe"C:\Users\Admin\AppData\Local\Temp\mgcwgf.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\hwksyv.exe"C:\Users\Admin\AppData\Local\Temp\hwksyv.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\rjmffb.exe"C:\Users\Admin\AppData\Local\Temp\rjmffb.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\xmosor.exe"C:\Users\Admin\AppData\Local\Temp\xmosor.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\wycill.exe"C:\Users\Admin\AppData\Local\Temp\wycill.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\titfqh.exe"C:\Users\Admin\AppData\Local\Temp\titfqh.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nmjstq.exe"C:\Users\Admin\AppData\Local\Temp\nmjstq.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\axcgxv.exe"C:\Users\Admin\AppData\Local\Temp\axcgxv.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\scfgba.exe"C:\Users\Admin\AppData\Local\Temp\scfgba.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mtrlzi.exe"C:\Users\Admin\AppData\Local\Temp\mtrlzi.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dylzzq.exe"C:\Users\Admin\AppData\Local\Temp\dylzzq.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\clsfrt.exe"C:\Users\Admin\AppData\Local\Temp\clsfrt.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\retxsr.exe"C:\Users\Admin\AppData\Local\Temp\retxsr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pqagqj.exe"C:\Users\Admin\AppData\Local\Temp\pqagqj.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gngstx.exe"C:\Users\Admin\AppData\Local\Temp\gngstx.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pcmbov.exe"C:\Users\Admin\AppData\Local\Temp\pcmbov.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fbxlem.exe"C:\Users\Admin\AppData\Local\Temp\fbxlem.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cnklow.exe"C:\Users\Admin\AppData\Local\Temp\cnklow.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hoazwj.exe"C:\Users\Admin\AppData\Local\Temp\hoazwj.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hwhbtm.exe"C:\Users\Admin\AppData\Local\Temp\hwhbtm.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jjrvpp.exe"C:\Users\Admin\AppData\Local\Temp\jjrvpp.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gqpxrr.exe"C:\Users\Admin\AppData\Local\Temp\gqpxrr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\udmned.exe"C:\Users\Admin\AppData\Local\Temp\udmned.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zuykle.exe"C:\Users\Admin\AppData\Local\Temp\zuykle.exe"2⤵
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "zuykle" /tr "C:\Users\Admin\AppData\Roaming\zuykle.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\cwygcq.exe"C:\Users\Admin\AppData\Local\Temp\cwygcq.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ogrlxb.exe"C:\Users\Admin\AppData\Local\Temp\ogrlxb.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\yuzzyw.exe"C:\Users\Admin\AppData\Local\Temp\yuzzyw.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wpgdus.exe"C:\Users\Admin\AppData\Local\Temp\wpgdus.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ndilcu.exe"C:\Users\Admin\AppData\Local\Temp\ndilcu.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vgyuey.exe"C:\Users\Admin\AppData\Local\Temp\vgyuey.exe"2⤵
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {5D0F4207-0415-4C9B-843C-DB35959FEDBD} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\pyopnm.exeC:\Users\Admin\AppData\Roaming\pyopnm.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\fdkovh.exeC:\Users\Admin\AppData\Roaming\fdkovh.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\pyopnm.exeC:\Users\Admin\AppData\Roaming\pyopnm.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\fdkovh.exeC:\Users\Admin\AppData\Roaming\fdkovh.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\pyopnm.exeC:\Users\Admin\AppData\Roaming\pyopnm.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\bkbpaj.exeC:\Users\Admin\AppData\Roaming\bkbpaj.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\fdkovh.exeC:\Users\Admin\AppData\Roaming\fdkovh.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\pyopnm.exeC:\Users\Admin\AppData\Roaming\pyopnm.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\bkbpaj.exeC:\Users\Admin\AppData\Roaming\bkbpaj.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\fdkovh.exeC:\Users\Admin\AppData\Roaming\fdkovh.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\pyopnm.exeC:\Users\Admin\AppData\Roaming\pyopnm.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\hdnlsc.exeC:\Users\Admin\AppData\Roaming\hdnlsc.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\bkbpaj.exeC:\Users\Admin\AppData\Roaming\bkbpaj.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\fdkovh.exeC:\Users\Admin\AppData\Roaming\fdkovh.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\pyopnm.exeC:\Users\Admin\AppData\Roaming\pyopnm.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\hdnlsc.exeC:\Users\Admin\AppData\Roaming\hdnlsc.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\bdgstc.exeC:\Users\Admin\AppData\Roaming\bdgstc.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\bkbpaj.exeC:\Users\Admin\AppData\Roaming\bkbpaj.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\fdkovh.exeC:\Users\Admin\AppData\Roaming\fdkovh.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\pyopnm.exeC:\Users\Admin\AppData\Roaming\pyopnm.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\rproak.exeC:\Users\Admin\AppData\Roaming\rproak.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\bdgstc.exeC:\Users\Admin\AppData\Roaming\bdgstc.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\bkbpaj.exeC:\Users\Admin\AppData\Roaming\bkbpaj.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\pyopnm.exeC:\Users\Admin\AppData\Roaming\pyopnm.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\hdnlsc.exeC:\Users\Admin\AppData\Roaming\hdnlsc.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\fdkovh.exeC:\Users\Admin\AppData\Roaming\fdkovh.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\zuykle.exeC:\Users\Admin\AppData\Roaming\zuykle.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\rproak.exeC:\Users\Admin\AppData\Roaming\rproak.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\hdnlsc.exeC:\Users\Admin\AppData\Roaming\hdnlsc.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\fdkovh.exeC:\Users\Admin\AppData\Roaming\fdkovh.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\bdgstc.exeC:\Users\Admin\AppData\Roaming\bdgstc.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\bkbpaj.exeC:\Users\Admin\AppData\Roaming\bkbpaj.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\pyopnm.exeC:\Users\Admin\AppData\Roaming\pyopnm.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\zuykle.exeC:\Users\Admin\AppData\Roaming\zuykle.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\rproak.exeC:\Users\Admin\AppData\Roaming\rproak.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\bdgstc.exeC:\Users\Admin\AppData\Roaming\bdgstc.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\hdnlsc.exeC:\Users\Admin\AppData\Roaming\hdnlsc.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\fdkovh.exeC:\Users\Admin\AppData\Roaming\fdkovh.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\bkbpaj.exeC:\Users\Admin\AppData\Roaming\bkbpaj.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\atiemw.exeC:\Users\Admin\AppData\Roaming\atiemw.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\pyopnm.exeC:\Users\Admin\AppData\Roaming\pyopnm.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\jjwdsk.exeC:\Users\Admin\AppData\Roaming\jjwdsk.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\luvtlv.exeC:\Users\Admin\AppData\Roaming\luvtlv.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
161KB
MD5a2e166ef9ba63b78150b9e08767d0764
SHA1885c223c8436ee6184f6335f3bcf7bd761e85319
SHA2560626693b0820897af0b56b9092439ce955a2435b610127d1686ea256eddc230f
SHA51204651a2f9f4d648b95e7a5e67a1e1ddbaa12d8d2d1fecbf2da956b58826ad2f0aee2b1e182b1beab3f73215185f7c402df67fed4e0bcf401a2eea64ec34c627b
-
Filesize
166KB
MD57a7586c1278ecdb7881a3b34f841b722
SHA18c991bb42729a7e34a096f9d3b23e7e0a25329a8
SHA256e2e527d70759106b6d1f479d0a1edd99d9b57c7fdfde2fffd1705e2161438a7f
SHA51279ddd9f08587767ab6b2b66fa7873b0de9a51b8ee52abe8b9ed7e7cf9c42ddd3e45069e978bde40e1708c44a7d8c6a5c271e1dd7129501227dcd8dc5477872b2
-
Filesize
161KB
MD5760aa2ef40d31c55f0019cc916e9de48
SHA10228e46ca0a0303bebf54a65bf5da8111c4de402
SHA2567ae58db4879d8daf291c5eab58ca9b49bc1b5c63153a02d175d83406a71a2806
SHA512ce85a4af522b22d696ff98e176e2f97280363ac5e4161e39dac8cb0404af8d20fc4efe0ddd9e39cfa07bef28b65960c9a56822c6436b715f37ec6df9bd512d04
-
Filesize
152KB
MD5c0a4054bc0a6553d3a246d91e6cdc95b
SHA1b8722a0cf5483539ce965098fb299ad129d1a36b
SHA2560c20402e4957de72ae5e6c5ce00d0dfab6a49affb260996b3290d44264977909
SHA5125f5e88e876e6363992cd28794203874d27fc204bc7df004d32bfa18ebd0797c8c89ccb6b4cc44d4bdf6a9b476d5be5bec2a91bdc7020ba7b3628b98c9587ea5e
-
Filesize
158KB
MD5eccccd69bbde41339441e5278f21bc10
SHA1d1d96bfea61f93c10064417f3682bcebd682a7ad
SHA25669074dfb9990c949ae7238d95ff74d2cd294e54759ee1f087519aec081098541
SHA512edb20574c49e7495eef969113f3a38979b8ef85669da30de4c0e0632ea2467fc3e11ef62686e32b5c90d29e99abc66d5cdc97d5bc420f356eb04b72e71553dea
-
Filesize
34KB
MD5950d739da650457fab6a225545794238
SHA1e965286161ecda1b8c0072d8a2d80c191bb15705
SHA256a571fcac5384158c4927e7c7cf07182b68eccf67845ba927beae44cd9835e3f8
SHA512b7b91343176c5a7f6408b21fbc96c23d0b02c080b846e29f304ba91de1d0f37a772953e7ab65d1d627cb3490fbef3b85681564e878d8dcda57c0897dbad1d19b
-
Filesize
159KB
MD5c73cfd1942fdfaf5d6f3940ca42bbadd
SHA19c9424953c85d03daf296d7841577228d15e1884
SHA2563d735b082f087b25561d293d17a6cda64326f3d48c1db53a2941ded1afc78773
SHA5129d7ce397b67e704773f7a9ea6c9cd1e5345f2211a67ac5dd5f622118690ed295a18e763c47e5c208240f71d4bedb67ba1e869faff466602f8e97350f9df9495c
-
Filesize
159KB
MD549a6b6e8627762b929999b0b1fe6d604
SHA14a47bbb17c6cbda79794428df97d203b7261af79
SHA256ca6aa52d419303376de2c37b4c8f6bdd41e31e55de6d178520ad5056303b6571
SHA512c967dcb9be6b1fa73f1ef50a7785c17919365857be63923c6cad53362931d9a1c9fb41a43d68a050ad2a50239580fc8294e61e2ba10ee19d185f4f91c035b85b
-
Filesize
156KB
MD5e2cf7cb958bda8d948e80bdb78d6e283
SHA134c18cf619966914046b7a8f9070b0ee9ca0523d
SHA25607f878b812dc294a61fb6030dffab309e4a05bef322759a198f110aa88c3b402
SHA5123197a3a08069a2a33cea248503132dff4369efe6b83d13db61ef5be81e26f5c3f57ecba9c31e73754f321848dcf491f19eb0249f5f182c2332ae0879ed84b56c
-
Filesize
30KB
MD5d8a05fae946f16dbb12d5489f2b68230
SHA1f8068ceb85905539ed39dc4dc187088487b09e17
SHA2567876b3d0721a40d4d80f873be9ff79e722e28bd24ba0ee9ab9faac5c7aa69899
SHA512661fc778e40c260756d928fe3bed91c3cbc8884ac27a071e1bf3c8f97c9133bd4bd853371baed477a3988305c12e1c405d03059f8652d810a23eb6050f6ade77
-
Filesize
151KB
MD55cdc9671612660bd34747c635218a649
SHA18cebfbdfc27689d9988d4512da7d855c13eb8e0b
SHA256119b3e5a0b2aad4dc9a6a7376dde77e80826830a24a08aefd858710e79a11db9
SHA512a33bfb9c9db6469274a38bee8038fa7a86b2e336e48776bee788b7b2b372556b5880253cdc7856339130ca8b29c199a739020e78ca29cc401f441e2ac18280ef
-
Filesize
59KB
MD56c091ad6fae0fa76f44870d1a1b05cb4
SHA1040f60c0ee3f4902f919025057e34ab4d11b1abd
SHA256c352c942b6df33510094c7100fb9d48e36b8e1e2af40a60ccc360b58721c2390
SHA5123a414f40f99e5847d9631c4ac1143c76e77db7ae42dd8c7aed2ebf1742ec73bb802d54d6cbde3b04f6b894a4cf731aa4e9dbad95166bade13f787b489d8e8d86
-
Filesize
7KB
MD53b338e2f9c5a04470d8a05e93ed7c326
SHA14df9ff7c5269aeebd3309ae300319fb863c56f82
SHA256f09b1058687cefe73eff397b4d3fa98e726c60d935e6ee16a2245148c732aa4b
SHA5126ec04aea2c6eda77450a8c07af00204bfe5b6323644f17bad9c9907993ced981cd19264b91fdf64f04a81b7a5ebde3026a9d6bf17f66623639d1a2b514e22892
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
88KB
-
Filesize
176KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
176KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
88KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
192KB
-
Filesize
56KB
-
Filesize
184KB
-
Filesize
192KB
-
Filesize
176KB
-
Filesize
88KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
192KB
-
Filesize
56KB
-
Filesize
192KB
-
Filesize
184KB
-
Filesize
192KB
-
Filesize
176KB
-
Filesize
88KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
184KB
-
Filesize
192KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
176KB
-
Filesize
56KB
-
Filesize
192KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
88KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
56KB
-
Filesize
88KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
88KB
-
Filesize
176KB
-
Filesize
56KB
-
Filesize
176KB
-
Filesize
56KB