Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 19:11
General
- Target 5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe
- Size 606KB
- Sample260910-xvwqcaxtdv
- SHA256 5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Modifies visibility of file extensions in Explorer 2 TTPs 26 IoCs
- UAC bypass 3 TTPs 26 IoCs
- Renames multiple (131) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 7 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 26 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 52 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 21 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe"C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\VscosUsg\rKQoIYco.exe"C:\Users\Admin\VscosUsg\rKQoIYco.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\vmIgUocw\AMQUUIIk.exe"C:\ProgramData\vmIgUocw\AMQUUIIk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d9⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d15⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d19⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"20⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d21⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"22⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"24⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"26⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"28⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"30⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"36⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"38⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d41⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"44⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d45⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"46⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d47⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"48⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exeC:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d"52⤵
- Executes a command shell one-liner
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OcssEwgQ.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""52⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aWIUooEY.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""50⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rqgkoIkM.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hOgYwIUA.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EuIQYMIo.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""44⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TigYoQAc.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NuwMMYEQ.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""40⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mggkwMsM.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""38⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YeUMkwMA.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""36⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jAYIcAMU.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""34⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OyoEIooU.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""32⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gasAIAUg.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bMYwIgQA.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""28⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kuIcoEsM.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aeQgwgMM.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\duMswIQM.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JgEowwkQ.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""20⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LeogYUkU.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wEAoEscQ.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tUMwsooQ.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lOggcUAg.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jkUIsIMM.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UqsMIEwg.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CCgkMQAU.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NAYscAUE.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SKwEUEok.bat" "C:\Users\Admin\AppData\Local\Temp\5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d.exe""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\qQIAIMcc\DSgAogcw.exeC:\ProgramData\qQIAIMcc\DSgAogcw.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\ProgramData\vmIgUocw\AMQUUIIk.exeC:\ProgramData\vmIgUocw\AMQUUIIk.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\VscosUsg\rKQoIYco.exeC:\Users\Admin\VscosUsg\rKQoIYco.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
superbar.png.exe
DSgAogcw.exe
AMQUUIIk.exe
96.png.exe
ScreenshotOptIn.gif.exe
5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d
AEoq.exe
AQcO.exe
AYce.exe
AoAk.ico
AsgE.exe
AwII.exe
CIAo.exe
CIYu.exe
CIsC.exe
CMII.exe
CYok.exe
CcIC.exe
CoIe.exe
CsYG.exe
CygQ.ico
EMoW.exe
Egwo.exe
EsYW.exe
GcIg.exe
Gcke.exe
GgIs.exe
GkAm.exe
GoQA.exe
IYUi.exe
IkIM.ico
Iksu.exe
Iokm.exe
Iski.exe
KQcO.exe
KUYY.exe
KgwI.exe
Kkkc.exe
KssQ.exe
MEQY.exe
MEYY.ico
MIUq.exe
MQUg.exe
MggG.exe
MksA.exe
MocC.exe
NAYscAUE.bat
OAsw.exe
OEsS.exe
OMAk.exe
OQsW.exe
OYsU.exe
OgoU.exe
OgsC.exe
OoYw.ico
OosC.exe
OsAW.exe
Owok.exe
QEAg.ico
QIsm.exe
QUQo.exe
QicU.ico
QkMa.exe
Qkwk.exe
Qowg.exe
QwUY.exe
QwoI.exe
SCIw.ico
SIEs.exe
SIIk.exe
SMUk.exe
SQoA.exe
SkoI.exe
SooG.exe
SsEw.exe
UIoG.exe
UKgg.ico
UQIk.exe
UQMo.exe
UcMa.exe
UsMY.exe
UsMy.exe
Usgi.exe
UwUu.exe
WMQI.ico
WMkW.exe
WMkY.exe
WYAo.exe
YAUk.exe
YIMW.exe
YMYa.exe
YMgy.exe
YQse.exe
YcEy.exe
YsEu.exe
YsEy.exe
YsgI.exe
aAIw.exe
aEEI.exe
aQoq.exe
aUoG.exe
asMc.exe
asQc.exe
cIIS.exe
cMMU.exe
cYsm.exe
cgQo.exe
ckcE.exe
eEYs.exe
eYcG.exe
eiss.ico
eosM.exe
file.vbs
gMEO.exe
gQko.exe
gYoM.exe
gcYu.exe
iAYq.exe
iQEu.exe
iSME.ico
iYIu.exe
isYq.exe
isgI.exe
kMca.exe
kUQc.exe
kUcw.exe
kYIM.exe
kccy.exe
kgkk.exe
kwIA.exe
kwci.exe
mIQo.exe
mkcm.exe
mwQs.exe
oMEm.exe
ocsM.exe
ogco.exe
osMy.exe
owEU.exe
qAUO.exe
qIom.exe
qQUm.exe
qUYI.exe
qUko.exe
qYki.exe
qkYQ.exe
qsEi.exe
qwEC.exe
qwEg.exe
sMsI.exe
sQgI.exe
sQkw.exe
sUsI.exe
sYUY.exe
soMq.exe
uUUq.exe
uggk.exe
uoQs.exe
wUUs.exe
yEkO.exe
ReadDebug.rar.exe
ConnectUndo.gif.exe
EnterSet.wma.exe
ExitRedo.rar.exe
SubmitClose.bmp.exe
ImportDisconnect.xlsb.exe
MergeSplit.bmp.exe
SkipPing.png.exe
RestartRestore.mp3.exe
WatchTest.zip.exe
EditMount.rar.exe
CompleteResume.xls.exe
FormatResize.mp3.exe
rKQoIYco.exe