Overview
overview
7Static
static
5OUninstall.exe
windows10-2004-x64
7OUninstall.exe
windows11-ltsc_2024-x64
7OUninstall_x64.exe
windows10-2004-x64
7OUninstall_x64.exe
windows11-ltsc_2024-x64
7윈도우 ...IO.cmd
windows10-2004-x64
4윈도우 ...IO.cmd
windows11-ltsc_2024-x64
4윈도우�...5p.exe
windows10-2004-x64
5윈도우�...5p.exe
windows11-ltsc_2024-x64
5Analysis
- max time kernel
149s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 13:28
Behavioral task
behavioral1
Sample
OUninstall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
OUninstall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
OUninstall_x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
OUninstall_x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target OUninstall.exe
- Size 2.9MB
- Sample261024-qqwffsh191
- SHA256 ca9522744e96899df991c073c66a65a86b753c12bba71a83a28cd73f4f330b1c
- MD5 dcd30da513a3348c4a34c70121dab8ab
- SHA1 6ecd365e1a65e3f04a14264cf9acf96d8e0eec60
- SHA512 16588aa24e47cf22f123f755955daa410e68417330cebd4d9cae2c61b956846ba8f1a98283dc7e370680e09293a2e3dd3ca76a43a177a35ec883e08582c631f6
- SSDEEP 24576:TO+rnnOxyCZisUZw85zkI3nugEGcarV7CqViXtxAadq/WEtO8O/en9uRuu:TOkOxJAzzNccMkItxNs+Ebuen9c
- TLSH T138E5B8106FFA0114F1B2EA74D9B64025CB27B9565A36C94E718C09CE1FB7580C9FBB3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 1624 files.exe 2292 files.exe 4576 files.exe 3248 files.exe 2208 files.exe 3872 files.exe 4616 files.exe 700 files.exe 4476 files.exe 6004 files.exe 6120 files.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 11 IoCs
pid Process 5644 cscript.exe 5008 cscript.exe 4088 cscript.exe 4864 cscript.exe 2892 cscript.exe 1624 cscript.exe 5472 cscript.exe 1188 cscript.exe 2528 cscript.exe 3404 cscript.exe 4844 cscript.exe - Executes a command shell one-liner 1 TTPs 12 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3016 cmd.exe 5812 cmd.exe 3576 cmd.exe 1840 cmd.exe 1860 cmd.exe 3312 cmd.exe 2328 cmd.exe 4216 cmd.exe 2012 cmd.exe 4516 cmd.exe 3388 cmd.exe 2084 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1960 WMIC.exe 1960 WMIC.exe 1960 WMIC.exe 1960 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1960 WMIC.exe Token: SeSecurityPrivilege 1960 WMIC.exe Token: SeTakeOwnershipPrivilege 1960 WMIC.exe Token: SeLoadDriverPrivilege 1960 WMIC.exe Token: SeSystemProfilePrivilege 1960 WMIC.exe Token: SeSystemtimePrivilege 1960 WMIC.exe Token: SeProfSingleProcessPrivilege 1960 WMIC.exe Token: SeIncBasePriorityPrivilege 1960 WMIC.exe Token: SeCreatePagefilePrivilege 1960 WMIC.exe Token: SeBackupPrivilege 1960 WMIC.exe Token: SeRestorePrivilege 1960 WMIC.exe Token: SeShutdownPrivilege 1960 WMIC.exe Token: SeDebugPrivilege 1960 WMIC.exe Token: SeSystemEnvironmentPrivilege 1960 WMIC.exe Token: SeRemoteShutdownPrivilege 1960 WMIC.exe Token: SeUndockPrivilege 1960 WMIC.exe Token: SeManageVolumePrivilege 1960 WMIC.exe Token: 33 1960 WMIC.exe Token: 34 1960 WMIC.exe Token: 35 1960 WMIC.exe Token: 36 1960 WMIC.exe Token: SeIncreaseQuotaPrivilege 1960 WMIC.exe Token: SeSecurityPrivilege 1960 WMIC.exe Token: SeTakeOwnershipPrivilege 1960 WMIC.exe Token: SeLoadDriverPrivilege 1960 WMIC.exe Token: SeSystemProfilePrivilege 1960 WMIC.exe Token: SeSystemtimePrivilege 1960 WMIC.exe Token: SeProfSingleProcessPrivilege 1960 WMIC.exe Token: SeIncBasePriorityPrivilege 1960 WMIC.exe Token: SeCreatePagefilePrivilege 1960 WMIC.exe Token: SeBackupPrivilege 1960 WMIC.exe Token: SeRestorePrivilege 1960 WMIC.exe Token: SeShutdownPrivilege 1960 WMIC.exe Token: SeDebugPrivilege 1960 WMIC.exe Token: SeSystemEnvironmentPrivilege 1960 WMIC.exe Token: SeRemoteShutdownPrivilege 1960 WMIC.exe Token: SeUndockPrivilege 1960 WMIC.exe Token: SeManageVolumePrivilege 1960 WMIC.exe Token: 33 1960 WMIC.exe Token: 34 1960 WMIC.exe Token: 35 1960 WMIC.exe Token: 36 1960 WMIC.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe 4480 OUninstall.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4480 wrote to memory of 3016 4480 OUninstall.exe 89 PID 3016 wrote to memory of 1960 3016 cmd.exe 91 PID 4480 wrote to memory of 4616 4480 OUninstall.exe 93 PID 4480 wrote to memory of 4216 4480 OUninstall.exe 95 PID 4216 wrote to memory of 1624 4216 cmd.exe 97 PID 4480 wrote to memory of 5644 4480 OUninstall.exe 98 PID 4480 wrote to memory of 436 4480 OUninstall.exe 101 PID 4480 wrote to memory of 5812 4480 OUninstall.exe 103 PID 5812 wrote to memory of 2292 5812 cmd.exe 105 PID 4480 wrote to memory of 5008 4480 OUninstall.exe 106 PID 4480 wrote to memory of 4476 4480 OUninstall.exe 108 PID 4480 wrote to memory of 2012 4480 OUninstall.exe 110 PID 2012 wrote to memory of 4576 2012 cmd.exe 112 PID 4480 wrote to memory of 2528 4480 OUninstall.exe 113 PID 4480 wrote to memory of 5036 4480 OUninstall.exe 115 PID 4480 wrote to memory of 4516 4480 OUninstall.exe 117 PID 4516 wrote to memory of 3248 4516 cmd.exe 119 PID 4480 wrote to memory of 4088 4480 OUninstall.exe 120 PID 4480 wrote to memory of 1560 4480 OUninstall.exe 122 PID 4480 wrote to memory of 3576 4480 OUninstall.exe 124 PID 3576 wrote to memory of 2208 3576 cmd.exe 126 PID 4480 wrote to memory of 4864 4480 OUninstall.exe 127 PID 4480 wrote to memory of 4288 4480 OUninstall.exe 129 PID 4480 wrote to memory of 1840 4480 OUninstall.exe 131 PID 1840 wrote to memory of 3872 1840 cmd.exe 133 PID 4480 wrote to memory of 2892 4480 OUninstall.exe 134 PID 4480 wrote to memory of 2720 4480 OUninstall.exe 136 PID 4480 wrote to memory of 3388 4480 OUninstall.exe 138 PID 3388 wrote to memory of 4616 3388 cmd.exe 140 PID 4480 wrote to memory of 1624 4480 OUninstall.exe 141 PID 4480 wrote to memory of 4280 4480 OUninstall.exe 143 PID 4480 wrote to memory of 1860 4480 OUninstall.exe 145 PID 1860 wrote to memory of 700 1860 cmd.exe 147 PID 4480 wrote to memory of 5472 4480 OUninstall.exe 148 PID 4480 wrote to memory of 1916 4480 OUninstall.exe 150 PID 4480 wrote to memory of 2084 4480 OUninstall.exe 152 PID 2084 wrote to memory of 4476 2084 cmd.exe 154 PID 4480 wrote to memory of 1188 4480 OUninstall.exe 155 PID 4480 wrote to memory of 4576 4480 OUninstall.exe 157 PID 4480 wrote to memory of 3312 4480 OUninstall.exe 159 PID 3312 wrote to memory of 6004 3312 cmd.exe 161 PID 4480 wrote to memory of 3404 4480 OUninstall.exe 162 PID 4480 wrote to memory of 3208 4480 OUninstall.exe 165 PID 4480 wrote to memory of 2328 4480 OUninstall.exe 167 PID 2328 wrote to memory of 6120 2328 cmd.exe 169 PID 4480 wrote to memory of 4844 4480 OUninstall.exe 170
Processes
-
C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4616
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1624
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5644
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:436
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2292
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5008
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4476
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4576
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:2528
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:5036
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3248
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4088
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:1560
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2208
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4864
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4288
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3872
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:2892
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:2720
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4616
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:1624
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4280
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:700
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5472
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:1916
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4476
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:1188
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4576
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6004
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:3404
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:3208
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6120
-
-
-
C:\Windows\system32\cscript.exe"C:\Windows\Sysnative\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4844
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5872
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\OffScrubC2R\ScrubRetValFile.txt
- Size 24B
- SHA256 44119689fd681e69b50ff356faccd21bc3dfba827564dc1540910e7ee4fed75e
- MD5 07ddc9b29e487769e638da3e8277818e
- SHA1 8b414f25590ec81f94d3b30a31ac0cef49ff4db1
- SHA512 69ba8f825bc0cb8f1953df600d64794c4c4bbfad9e4303348c3e37dd66d8dd88c913df63bbc69a370cf7d2add22934da47760985c64c9a773d2d20bc2515ff49
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs
- Size 163KB
- SHA256 ff40619539bcfb5340d2a33dbc1a1e7b80c68e2c1e10c2aa4ca4a44087962098
- MD5 3103cf4c375a9c190ba59bc28e63b42a
- SHA1 a86ec75f582dff02676a7a859a93e9bbb89e8205
- SHA512 401640eed069c95d30f3f4b904c9e6e836015a4077b3abfe4c766910b356dcaabfdfd965daa31458b374daca3e8c616138e347201a786eace255e0b9cf2f17f4
- SSDEEP 1536:yrXgfa9I8Lk4f7tAtwr9pBrMujLXXHjlmOzz2ZN4OZ7:8gfa9I8LkKCOjBrMu3XXHjlNzmZ7
- TLSH T1D0F3D503BF4352359470D242AC3ADC6BFBAA1A5F90160518F98DB0511F7A69F81FD2EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\Uninstall.xml
- Size 59B
- SHA256 09d5b42140bab13165ba97fbd0e77792304c3c93555be02c3dce21a7a69c66dd
- MD5 364f86f97324ea82fe0d142cd01cf6dd
- SHA1 fc2a45da2ede0c018ab8e46044e6a25765c27d99
- SHA512 9b0a0944535e25c944e01bed1674efff119505292b176287c0dad3db70ffc4244cff21cccfd1fd94b09dd6d5f84221930b66b210101e482cc4bb5df3311a5fdf
- TLSH T1C3A0028720200D07B1570357C4AB1008F9301721C11C115CE06E3633152913C5352001
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\files.exe
- Size 765KB
- SHA256 4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e
- MD5 bb5569b15d68c10b7ff2d96b45825120
- SHA1 d6d2ed450aae4552f550f59bffe3dd42d8377835
- SHA512 640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957
- SSDEEP 12288:qXRqml2fcarViUC6TViXyKxhqahbqiR6WEttE6iITi44eKwV3uSI:ygEGcarV7CqViXtxAadq/WEtO8O/en9S
- TLSH T1C2F402313AE6C2BBD643123185CCBBB5B1EA97490F1528C323D4CF1D6F798A6D239919
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x64\cleanospp.exe
- Size 28KB
- SHA256 edf85f4e2ef1a427b34265a22f261d664ec78de90c3b5da4174ef28558c8522a
- MD5 d3467cb7b83b654c2d05407dc7ba2360
- SHA1 af7b4fdde21434f9e8d2e90fbff7b1d64af8a0a3
- SHA512 0998bc55b4b928077144cececfaaeee6d957f5acfcfab083987b2ba1e039ca9bf2156c633213c8a3c1ccd874d6ea31e5e1b8e0de6fdfd42693f844aca4408c5e
- SSDEEP 384:AQAInWKpEFFzpjq37oIOU6GHq33QPiu431VPjdOKV1TQilrkK:AxWTpOFagUb2qiu43P7PV1D
- TLSH T14FD218A00FF900D2E177FA70CBB48916ED35F99629319A5F1591C5440E33B82FF26B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x64\msvcr100.dll
- Size 809KB
- SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
- MD5 df3ca8d16bded6a54977b30e66864d33
- SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
- SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
- SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
- TLSH T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x86\cleanospp.exe
- Size 25KB
- SHA256 04ba4487f95290e0b0557b44300c18f637fbaf0872ee96e3111013b8a1539f25
- MD5 98821a7a5737d656633d10a3afb724bd
- SHA1 0307ba03137de39735c6e5bde8afd22d5279f0f9
- SHA512 5e32cfa18cf6353bd36194ef9f00d0768fb5ec9723582d7ca72fcf60931ba08199d750270307e1c82adf57fb801855be6986f26e09b02aa7a5db74e95e3263ff
- SSDEEP 384:N9FuUOvAiG0gIVDKDYgmh02HPwzi3AnXdOKV1TE54UslGsGK3:wUAAYgmO21QXPV1Y1i3
- TLSH T168C249614FF80452E5B65EB05FF0C413BE3ABB962D718D5E565185040C22BC3EAB6F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x86\msvcr100.dll
- Size 755KB
- SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
- MD5 bf38660a9125935658cfa3e53fdc7d65
- SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
- SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
- SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
- TLSH T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH