Overview
overview
7Static
static
5OUninstall.exe
windows10-2004-x64
7OUninstall.exe
windows11-ltsc_2024-x64
7OUninstall_x64.exe
windows10-2004-x64
7OUninstall_x64.exe
windows11-ltsc_2024-x64
7윈도우 ...IO.cmd
windows10-2004-x64
4윈도우 ...IO.cmd
windows11-ltsc_2024-x64
4윈도우�...5p.exe
windows10-2004-x64
5윈도우�...5p.exe
windows11-ltsc_2024-x64
5Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 13:28
Behavioral task
behavioral1
Sample
OUninstall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
OUninstall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
OUninstall_x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
OUninstall_x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target OUninstall.exe
- Size 2.9MB
- Sample261024-qqwffsh191
- SHA256 ca9522744e96899df991c073c66a65a86b753c12bba71a83a28cd73f4f330b1c
- MD5 dcd30da513a3348c4a34c70121dab8ab
- SHA1 6ecd365e1a65e3f04a14264cf9acf96d8e0eec60
- SHA512 16588aa24e47cf22f123f755955daa410e68417330cebd4d9cae2c61b956846ba8f1a98283dc7e370680e09293a2e3dd3ca76a43a177a35ec883e08582c631f6
- SSDEEP 24576:TO+rnnOxyCZisUZw85zkI3nugEGcarV7CqViXtxAadq/WEtO8O/en9uRuu:TOkOxJAzzNccMkItxNs+Ebuen9c
- TLSH T138E5B8106FFA0114F1B2EA74D9B64025CB27B9565A36C94E718C09CE1FB7580C9FBB3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 3096 files.exe 1700 files.exe 2112 files.exe 1332 files.exe 2460 files.exe 4960 files.exe 2500 files.exe 1012 files.exe 1276 files.exe 1428 files.exe 2476 files.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 11 IoCs
pid Process 3600 cscript.exe 4764 cscript.exe 4220 cscript.exe 4480 cscript.exe 3256 cscript.exe 4176 cscript.exe 2144 cscript.exe 4824 cscript.exe 1500 cscript.exe 2428 cscript.exe 4452 cscript.exe - Executes a command shell one-liner 1 TTPs 12 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3112 cmd.exe 3628 cmd.exe 2608 cmd.exe 1680 cmd.exe 892 cmd.exe 4400 cmd.exe 2308 cmd.exe 2836 cmd.exe 4456 cmd.exe 2296 cmd.exe 944 cmd.exe 2404 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3764 WMIC.exe Token: SeSecurityPrivilege 3764 WMIC.exe Token: SeTakeOwnershipPrivilege 3764 WMIC.exe Token: SeLoadDriverPrivilege 3764 WMIC.exe Token: SeSystemProfilePrivilege 3764 WMIC.exe Token: SeSystemtimePrivilege 3764 WMIC.exe Token: SeProfSingleProcessPrivilege 3764 WMIC.exe Token: SeIncBasePriorityPrivilege 3764 WMIC.exe Token: SeCreatePagefilePrivilege 3764 WMIC.exe Token: SeBackupPrivilege 3764 WMIC.exe Token: SeRestorePrivilege 3764 WMIC.exe Token: SeShutdownPrivilege 3764 WMIC.exe Token: SeDebugPrivilege 3764 WMIC.exe Token: SeSystemEnvironmentPrivilege 3764 WMIC.exe Token: SeRemoteShutdownPrivilege 3764 WMIC.exe Token: SeUndockPrivilege 3764 WMIC.exe Token: SeManageVolumePrivilege 3764 WMIC.exe Token: 33 3764 WMIC.exe Token: 34 3764 WMIC.exe Token: 35 3764 WMIC.exe Token: 36 3764 WMIC.exe Token: SeIncreaseQuotaPrivilege 3764 WMIC.exe Token: SeSecurityPrivilege 3764 WMIC.exe Token: SeTakeOwnershipPrivilege 3764 WMIC.exe Token: SeLoadDriverPrivilege 3764 WMIC.exe Token: SeSystemProfilePrivilege 3764 WMIC.exe Token: SeSystemtimePrivilege 3764 WMIC.exe Token: SeProfSingleProcessPrivilege 3764 WMIC.exe Token: SeIncBasePriorityPrivilege 3764 WMIC.exe Token: SeCreatePagefilePrivilege 3764 WMIC.exe Token: SeBackupPrivilege 3764 WMIC.exe Token: SeRestorePrivilege 3764 WMIC.exe Token: SeShutdownPrivilege 3764 WMIC.exe Token: SeDebugPrivilege 3764 WMIC.exe Token: SeSystemEnvironmentPrivilege 3764 WMIC.exe Token: SeRemoteShutdownPrivilege 3764 WMIC.exe Token: SeUndockPrivilege 3764 WMIC.exe Token: SeManageVolumePrivilege 3764 WMIC.exe Token: 33 3764 WMIC.exe Token: 34 3764 WMIC.exe Token: 35 3764 WMIC.exe Token: 36 3764 WMIC.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe 860 OUninstall.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 860 wrote to memory of 4456 860 OUninstall.exe 84 PID 4456 wrote to memory of 3764 4456 cmd.exe 86 PID 860 wrote to memory of 984 860 OUninstall.exe 93 PID 860 wrote to memory of 2296 860 OUninstall.exe 95 PID 2296 wrote to memory of 3096 2296 cmd.exe 98 PID 860 wrote to memory of 4220 860 OUninstall.exe 99 PID 860 wrote to memory of 556 860 OUninstall.exe 102 PID 860 wrote to memory of 1680 860 OUninstall.exe 104 PID 1680 wrote to memory of 1700 1680 cmd.exe 106 PID 860 wrote to memory of 4480 860 OUninstall.exe 107 PID 860 wrote to memory of 1976 860 OUninstall.exe 111 PID 860 wrote to memory of 892 860 OUninstall.exe 113 PID 892 wrote to memory of 2112 892 cmd.exe 115 PID 860 wrote to memory of 3256 860 OUninstall.exe 116 PID 860 wrote to memory of 4656 860 OUninstall.exe 118 PID 860 wrote to memory of 944 860 OUninstall.exe 120 PID 944 wrote to memory of 1332 944 cmd.exe 122 PID 860 wrote to memory of 4176 860 OUninstall.exe 123 PID 860 wrote to memory of 1892 860 OUninstall.exe 125 PID 860 wrote to memory of 2404 860 OUninstall.exe 127 PID 2404 wrote to memory of 2460 2404 cmd.exe 129 PID 860 wrote to memory of 4452 860 OUninstall.exe 130 PID 860 wrote to memory of 1408 860 OUninstall.exe 132 PID 860 wrote to memory of 4400 860 OUninstall.exe 134 PID 4400 wrote to memory of 4960 4400 cmd.exe 136 PID 860 wrote to memory of 2144 860 OUninstall.exe 137 PID 860 wrote to memory of 3308 860 OUninstall.exe 139 PID 860 wrote to memory of 3112 860 OUninstall.exe 141 PID 3112 wrote to memory of 2500 3112 cmd.exe 143 PID 860 wrote to memory of 4824 860 OUninstall.exe 144 PID 860 wrote to memory of 3260 860 OUninstall.exe 146 PID 860 wrote to memory of 3628 860 OUninstall.exe 148 PID 3628 wrote to memory of 1012 3628 cmd.exe 150 PID 860 wrote to memory of 3600 860 OUninstall.exe 151 PID 860 wrote to memory of 4280 860 OUninstall.exe 153 PID 860 wrote to memory of 2308 860 OUninstall.exe 155 PID 2308 wrote to memory of 1276 2308 cmd.exe 157 PID 860 wrote to memory of 1500 860 OUninstall.exe 158 PID 860 wrote to memory of 2460 860 OUninstall.exe 160 PID 860 wrote to memory of 2836 860 OUninstall.exe 162 PID 2836 wrote to memory of 1428 2836 cmd.exe 164 PID 860 wrote to memory of 4764 860 OUninstall.exe 165 PID 860 wrote to memory of 3084 860 OUninstall.exe 167 PID 860 wrote to memory of 2608 860 OUninstall.exe 169 PID 2608 wrote to memory of 2476 2608 cmd.exe 171 PID 860 wrote to memory of 2428 860 OUninstall.exe 172
Processes
-
C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:984
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3096
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4220
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:556
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1700
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4480
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:1976
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2112
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:3256
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4656
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1332
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4176
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:1892
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2460
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4452
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:1408
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4960
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:2144
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:3308
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2500
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4824
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:3260
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1012
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:3600
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4280
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1276
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:1500
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:2460
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1428
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4764
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:3084
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2476
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:2428
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\OffScrubC2R\ScrubRetValFile.txt
- Size 24B
- SHA256 44119689fd681e69b50ff356faccd21bc3dfba827564dc1540910e7ee4fed75e
- MD5 07ddc9b29e487769e638da3e8277818e
- SHA1 8b414f25590ec81f94d3b30a31ac0cef49ff4db1
- SHA512 69ba8f825bc0cb8f1953df600d64794c4c4bbfad9e4303348c3e37dd66d8dd88c913df63bbc69a370cf7d2add22934da47760985c64c9a773d2d20bc2515ff49
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs
- Size 163KB
- SHA256 ff40619539bcfb5340d2a33dbc1a1e7b80c68e2c1e10c2aa4ca4a44087962098
- MD5 3103cf4c375a9c190ba59bc28e63b42a
- SHA1 a86ec75f582dff02676a7a859a93e9bbb89e8205
- SHA512 401640eed069c95d30f3f4b904c9e6e836015a4077b3abfe4c766910b356dcaabfdfd965daa31458b374daca3e8c616138e347201a786eace255e0b9cf2f17f4
- SSDEEP 1536:yrXgfa9I8Lk4f7tAtwr9pBrMujLXXHjlmOzz2ZN4OZ7:8gfa9I8LkKCOjBrMu3XXHjlNzmZ7
- TLSH T1D0F3D503BF4352359470D242AC3ADC6BFBAA1A5F90160518F98DB0511F7A69F81FD2EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\Uninstall.xml
- Size 59B
- SHA256 09d5b42140bab13165ba97fbd0e77792304c3c93555be02c3dce21a7a69c66dd
- MD5 364f86f97324ea82fe0d142cd01cf6dd
- SHA1 fc2a45da2ede0c018ab8e46044e6a25765c27d99
- SHA512 9b0a0944535e25c944e01bed1674efff119505292b176287c0dad3db70ffc4244cff21cccfd1fd94b09dd6d5f84221930b66b210101e482cc4bb5df3311a5fdf
- TLSH T1C3A0028720200D07B1570357C4AB1008F9301721C11C115CE06E3633152913C5352001
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\files.exe
- Size 765KB
- SHA256 4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e
- MD5 bb5569b15d68c10b7ff2d96b45825120
- SHA1 d6d2ed450aae4552f550f59bffe3dd42d8377835
- SHA512 640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957
- SSDEEP 12288:qXRqml2fcarViUC6TViXyKxhqahbqiR6WEttE6iITi44eKwV3uSI:ygEGcarV7CqViXtxAadq/WEtO8O/en9S
- TLSH T1C2F402313AE6C2BBD643123185CCBBB5B1EA97490F1528C323D4CF1D6F798A6D239919
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x64\cleanospp.exe
- Size 28KB
- SHA256 edf85f4e2ef1a427b34265a22f261d664ec78de90c3b5da4174ef28558c8522a
- MD5 d3467cb7b83b654c2d05407dc7ba2360
- SHA1 af7b4fdde21434f9e8d2e90fbff7b1d64af8a0a3
- SHA512 0998bc55b4b928077144cececfaaeee6d957f5acfcfab083987b2ba1e039ca9bf2156c633213c8a3c1ccd874d6ea31e5e1b8e0de6fdfd42693f844aca4408c5e
- SSDEEP 384:AQAInWKpEFFzpjq37oIOU6GHq33QPiu431VPjdOKV1TQilrkK:AxWTpOFagUb2qiu43P7PV1D
- TLSH T14FD218A00FF900D2E177FA70CBB48916ED35F99629319A5F1591C5440E33B82FF26B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x64\msvcr100.dll
- Size 809KB
- SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
- MD5 df3ca8d16bded6a54977b30e66864d33
- SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
- SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
- SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
- TLSH T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x86\cleanospp.exe
- Size 25KB
- SHA256 04ba4487f95290e0b0557b44300c18f637fbaf0872ee96e3111013b8a1539f25
- MD5 98821a7a5737d656633d10a3afb724bd
- SHA1 0307ba03137de39735c6e5bde8afd22d5279f0f9
- SHA512 5e32cfa18cf6353bd36194ef9f00d0768fb5ec9723582d7ca72fcf60931ba08199d750270307e1c82adf57fb801855be6986f26e09b02aa7a5db74e95e3263ff
- SSDEEP 384:N9FuUOvAiG0gIVDKDYgmh02HPwzi3AnXdOKV1TE54UslGsGK3:wUAAYgmO21QXPV1Y1i3
- TLSH T168C249614FF80452E5B65EB05FF0C413BE3ABB962D718D5E565185040C22BC3EAB6F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x86\msvcr100.dll
- Size 755KB
- SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
- MD5 bf38660a9125935658cfa3e53fdc7d65
- SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
- SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
- SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
- TLSH T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH