Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
15/04/2025, 23:20
General
-
Target
quarantine/fyBqr89.msi
-
Size
6.2MB
-
MD5
69d4092b3524bc2bff4e5c73509c3eb9
-
SHA1
43cb58b5635aea617dd93565c1baa15fde3eb0c0
-
SHA256
23662f3ca1692692dc1f090acaf814695eddbbf5dba15fd7b2c95f8ef6c47432
-
SHA512
2085868cba95b6cf87f1c47efff4b95ce930c3ac2706cecb4f8d66b5611c7af11423a9397d17ad581bd9769143c88010f4b278fa332c8655978aaa5d4f34eaff
-
SSDEEP
196608:kCLvDC8Y0BDC2zU0jRhsk2/0ReXyhNHnIy9c:1LC8dB3fjRhPhReXyHIy
Score
9/10
Malware Config
Signatures
-
Looks for VirtualBox drivers on disk 2 TTPs 64 IoCs
-
Looks for VMWare drivers on disk 2 TTPs 64 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 8 IoCs
-
Executes dropped EXE 32 IoCs
-
Loads dropped DLL 31 IoCs
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 13 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\quarantine\fyBqr89.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BE20BFC2283FB9DEE0599C92B204260D E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bam\aurelia_setup.exeC:\Users\Admin\AppData\Local\Temp\bam\aurelia_setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7OFE7.tmp\aurelia_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7OFE7.tmp\aurelia_setup.tmp" /SL5="$90264,5779210,860672,C:\Users\Admin\AppData\Local\Temp\bam\aurelia_setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART4⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Aurelia\Aurelia.exe"C:\Users\Public\Aurelia\Aurelia.exe"5⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe6⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe7⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe8⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"9⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid10⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe9⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"10⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid11⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe10⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"11⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid12⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe11⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"12⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid13⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"12⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe12⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"13⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid14⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"13⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"13⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe13⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"14⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid15⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"14⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"14⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe14⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"15⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid16⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"15⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"15⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe15⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"16⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid17⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"16⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"16⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe16⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"17⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid18⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"17⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"17⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe17⤵
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"18⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid19⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"18⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"18⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe18⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"19⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid20⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"19⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"19⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Public\Aurelia\Aurelia.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe2⤵
- Looks for VirtualBox drivers on disk
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe3⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe4⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe5⤵
- Looks for VirtualBox drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe6⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe7⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"8⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe8⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"9⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid10⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe9⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"10⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid11⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe10⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"11⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid12⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe11⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"12⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid13⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"12⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe12⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"13⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid14⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"13⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"13⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe13⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"14⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid15⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"14⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"14⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe14⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"15⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid16⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"15⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"15⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe15⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"16⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid17⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"16⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"16⤵
-
-
C:\Users\Public\Aurelia\Aurelia.exeC:\Users\Public\Aurelia\Aurelia.exe16⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"17⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid18⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"17⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"17⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Defense Evasion
Modify Registry
1System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51c5ac9835ecc16776a8014b791f09c94
SHA16f5c6e9fbc87caf3d6b65c1470366b3c95c06c0e
SHA256294c078f060741a7df1964ccedefbca0a433689011d940bfa1f8dcd5bb723eca
SHA51245e8af5a2970850d8c2d744a4f92efc1fcff9a665ebcea5cc9dbb9a221427f66db15c3d37dc056ab12760db4d6ef110f62b14d6e5697d1f3afccaba9f42aa962
-
Filesize
6.5MB
MD505550adb630b1113539470a138719946
SHA1b4a9760e9c1b2a516b15f853e71c1e37dc85fa94
SHA2566a5ae434d77e4678b61c5009127e2fac4ca988781c4f2af4581455da7af717c2
SHA5125827a4778d383ec5387051517f955a7b09fec8c95ca6cbc38dfd89afbd6c63ddc078d58007f8a6fd52c42406b51b0b6691114ebfa42325aa092b663066f368e3
-
Filesize
3.4MB
MD555d7b5023133d4ebbe3288d481a68b99
SHA16b706dee2daca913328ca6e4e5e6a85bc7f8ab0f
SHA25685c1f72de072ed57e63b35fa7d68a1d100a1685eab6c730632b5635006993929
SHA5128707cd9d7903522bbc0d6978a766c791740c57b6cf4ceba903175e8a7dd0c4d7f2d8787069ee3ba6abdf895d06448e1a07e8bc06c1d521160465a99efe04cb24
-
Filesize
8.7MB
MD5e0494504708c3df7ba7bb5e68a8f005d
SHA1414d7e6886405e969a89c490cdf6030cdeea362b
SHA256ff08761c5aaaff84aa6a0c216e6b486bfb823e2107717986c7c657b8e5b933b5
SHA512a4924cd7de04f5f430478a25bde70d5810e46bc48dab7f9d02166539b692f773e743db827b0f215ff3914057539a348957b5ccdab6b256dc26d6bde57fe7cb3b
-
Filesize
117KB
MD5caf9edded91c1f6c0022b278c16679aa
SHA14812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA25602c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
SHA51232ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
-
Filesize
215KB
MD58931e35055fd15b1acce7d7f24a23c36
SHA139b10e3171aaa4db9f8f14275b587fb82589d0ea
SHA2562b05bdcae15519ed4f61d1504f3226c2bcf04d358f3c54472b1d9b0aa3016860
SHA5122350f7935324565069aa747b4d3a7e416934ace1bf34a898d534dd316c829c1bd0601200fd84b7a3f60674a3e160f52949689a98c22766f271e1140dedc76c22
-
Filesize
24.1MB
MD527907715b7f47793f90f392bbe3e32eb
SHA1c7119036f21b59a56d3c574de462fee0e9303b4b
SHA256ef9a5989832d36882e383a73b45e833126361c2e9d96ee5a6677b6df2b63ef99
SHA512b9d8e82e00345c37c23d2485846f93d62a09aefc1a541c387bf324b2589941b3ab780485bd36744c9a76c27a62064f35ff1c3bc2506914ebbbc6b52978dd1401
-
Filesize
6KB
MD5e4336184a87050f3874a0e23c611511e
SHA158bfd569d747800119c9221e46886698397d270e
SHA25608b6ef2a47b9b88348ddaef7d8ad8726cd03ef10b8ec72074787d143b81a0af6
SHA512eeeac4a9f523826d5391bf4d0903b0f19b0cd968d2a89234e1621d5d2f99b5cf5d371a010459ff78c7f99400d44cb0792ab8ea7f6257b014303aa6ce06e66d04
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
5.8MB
-
Filesize
164KB
-
Filesize
84KB
-
Filesize
44KB
-
Filesize
128KB
-
Filesize
200KB
-
Filesize
904KB
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
164KB
-
Filesize
84KB