Overview
overview
7Static
static
5OUninstall.exe
windows10-2004-x64
7OUninstall.exe
windows11-ltsc_2024-x64
7OUninstall_x64.exe
windows10-2004-x64
7OUninstall_x64.exe
windows11-ltsc_2024-x64
7윈도우 ...IO.cmd
windows10-2004-x64
4윈도우 ...IO.cmd
windows11-ltsc_2024-x64
4윈도우�...5p.exe
windows10-2004-x64
5윈도우�...5p.exe
windows11-ltsc_2024-x64
5Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 13:28
Behavioral task
behavioral1
Sample
OUninstall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
OUninstall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
OUninstall_x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
OUninstall_x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target OUninstall_x64.exe
- Size 3.1MB
- Sample261024-qqwffsh191
- SHA256 17aa3a2e186c1a625a9e337defea3b65c820dc1dfeb0eb289702e0cc95bb3578
- MD5 e896a7c8d331c1e2e317f9a3cd0bb227
- SHA1 aee3ae0b7acffc57694009a0ff1880ac3015dad3
- SHA512 b48a9ab553b5a3ced79908ca2cb02163275694c14ab3530ebe53d00b2b20491ef9b89ad8a29d7ede7fefccb91b5f5c36cf7b7ad8ed2e8de4e7a7e65fb604aed6
- SSDEEP 24576:ZOFzXVDZq6FJ3/rWganJ/sJpORXy0BoJ0CpYo0NBbeGaD+wcvDpYbgEGcarV7CqJ:ur4Uxe456cRQiaccMkItxNs+Ebuen9c
- TLSH T17AE5B7106BF90118F2B3EA74D9764125CA3779565A35CA4E218C0ACE1F77980C9FFB3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 5516 files.exe 2952 files.exe 5292 files.exe 5924 files.exe 776 files.exe 5944 files.exe 4588 files.exe 2188 files.exe 4556 files.exe 3176 files.exe 3236 files.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 11 IoCs
pid Process 3092 cscript.exe 2860 cscript.exe 1228 cscript.exe 2840 cscript.exe 4632 cscript.exe 5172 cscript.exe 5808 cscript.exe 3880 cscript.exe 5144 cscript.exe 1696 cscript.exe 4524 cscript.exe - Executes a command shell one-liner 1 TTPs 12 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5876 cmd.exe 2368 cmd.exe 3788 cmd.exe 868 cmd.exe 3388 cmd.exe 1720 cmd.exe 2044 cmd.exe 4520 cmd.exe 2852 cmd.exe 4220 cmd.exe 1160 cmd.exe 4120 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2996 WMIC.exe Token: SeSecurityPrivilege 2996 WMIC.exe Token: SeTakeOwnershipPrivilege 2996 WMIC.exe Token: SeLoadDriverPrivilege 2996 WMIC.exe Token: SeSystemProfilePrivilege 2996 WMIC.exe Token: SeSystemtimePrivilege 2996 WMIC.exe Token: SeProfSingleProcessPrivilege 2996 WMIC.exe Token: SeIncBasePriorityPrivilege 2996 WMIC.exe Token: SeCreatePagefilePrivilege 2996 WMIC.exe Token: SeBackupPrivilege 2996 WMIC.exe Token: SeRestorePrivilege 2996 WMIC.exe Token: SeShutdownPrivilege 2996 WMIC.exe Token: SeDebugPrivilege 2996 WMIC.exe Token: SeSystemEnvironmentPrivilege 2996 WMIC.exe Token: SeRemoteShutdownPrivilege 2996 WMIC.exe Token: SeUndockPrivilege 2996 WMIC.exe Token: SeManageVolumePrivilege 2996 WMIC.exe Token: 33 2996 WMIC.exe Token: 34 2996 WMIC.exe Token: 35 2996 WMIC.exe Token: 36 2996 WMIC.exe Token: SeIncreaseQuotaPrivilege 2996 WMIC.exe Token: SeSecurityPrivilege 2996 WMIC.exe Token: SeTakeOwnershipPrivilege 2996 WMIC.exe Token: SeLoadDriverPrivilege 2996 WMIC.exe Token: SeSystemProfilePrivilege 2996 WMIC.exe Token: SeSystemtimePrivilege 2996 WMIC.exe Token: SeProfSingleProcessPrivilege 2996 WMIC.exe Token: SeIncBasePriorityPrivilege 2996 WMIC.exe Token: SeCreatePagefilePrivilege 2996 WMIC.exe Token: SeBackupPrivilege 2996 WMIC.exe Token: SeRestorePrivilege 2996 WMIC.exe Token: SeShutdownPrivilege 2996 WMIC.exe Token: SeDebugPrivilege 2996 WMIC.exe Token: SeSystemEnvironmentPrivilege 2996 WMIC.exe Token: SeRemoteShutdownPrivilege 2996 WMIC.exe Token: SeUndockPrivilege 2996 WMIC.exe Token: SeManageVolumePrivilege 2996 WMIC.exe Token: 33 2996 WMIC.exe Token: 34 2996 WMIC.exe Token: 35 2996 WMIC.exe Token: 36 2996 WMIC.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe 3884 OUninstall_x64.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 3884 wrote to memory of 3388 3884 OUninstall_x64.exe 87 PID 3388 wrote to memory of 2996 3388 cmd.exe 89 PID 3884 wrote to memory of 5732 3884 OUninstall_x64.exe 96 PID 3884 wrote to memory of 1720 3884 OUninstall_x64.exe 98 PID 1720 wrote to memory of 5516 1720 cmd.exe 100 PID 3884 wrote to memory of 2840 3884 OUninstall_x64.exe 101 PID 3884 wrote to memory of 5188 3884 OUninstall_x64.exe 106 PID 3884 wrote to memory of 2044 3884 OUninstall_x64.exe 108 PID 2044 wrote to memory of 2952 2044 cmd.exe 110 PID 3884 wrote to memory of 4632 3884 OUninstall_x64.exe 111 PID 3884 wrote to memory of 4804 3884 OUninstall_x64.exe 116 PID 3884 wrote to memory of 5876 3884 OUninstall_x64.exe 118 PID 5876 wrote to memory of 5292 5876 cmd.exe 120 PID 3884 wrote to memory of 5172 3884 OUninstall_x64.exe 121 PID 3884 wrote to memory of 1904 3884 OUninstall_x64.exe 123 PID 3884 wrote to memory of 4520 3884 OUninstall_x64.exe 125 PID 4520 wrote to memory of 5924 4520 cmd.exe 127 PID 3884 wrote to memory of 3092 3884 OUninstall_x64.exe 128 PID 3884 wrote to memory of 1844 3884 OUninstall_x64.exe 130 PID 3884 wrote to memory of 2368 3884 OUninstall_x64.exe 132 PID 2368 wrote to memory of 776 2368 cmd.exe 134 PID 3884 wrote to memory of 5808 3884 OUninstall_x64.exe 135 PID 3884 wrote to memory of 5544 3884 OUninstall_x64.exe 137 PID 3884 wrote to memory of 3788 3884 OUninstall_x64.exe 139 PID 3788 wrote to memory of 5944 3788 cmd.exe 141 PID 3884 wrote to memory of 3880 3884 OUninstall_x64.exe 142 PID 3884 wrote to memory of 1296 3884 OUninstall_x64.exe 144 PID 3884 wrote to memory of 2852 3884 OUninstall_x64.exe 146 PID 2852 wrote to memory of 4588 2852 cmd.exe 148 PID 3884 wrote to memory of 5144 3884 OUninstall_x64.exe 149 PID 3884 wrote to memory of 2072 3884 OUninstall_x64.exe 151 PID 3884 wrote to memory of 4220 3884 OUninstall_x64.exe 153 PID 4220 wrote to memory of 2188 4220 cmd.exe 155 PID 3884 wrote to memory of 1696 3884 OUninstall_x64.exe 156 PID 3884 wrote to memory of 4984 3884 OUninstall_x64.exe 158 PID 3884 wrote to memory of 1160 3884 OUninstall_x64.exe 160 PID 1160 wrote to memory of 4556 1160 cmd.exe 162 PID 3884 wrote to memory of 4524 3884 OUninstall_x64.exe 163 PID 3884 wrote to memory of 2060 3884 OUninstall_x64.exe 165 PID 3884 wrote to memory of 4120 3884 OUninstall_x64.exe 167 PID 4120 wrote to memory of 3176 4120 cmd.exe 169 PID 3884 wrote to memory of 2860 3884 OUninstall_x64.exe 170 PID 3884 wrote to memory of 2196 3884 OUninstall_x64.exe 172 PID 3884 wrote to memory of 868 3884 OUninstall_x64.exe 174 PID 868 wrote to memory of 3236 868 cmd.exe 176 PID 3884 wrote to memory of 1228 3884 OUninstall_x64.exe 177
Processes
-
C:\Users\Admin\AppData\Local\Temp\OUninstall_x64.exe"C:\Users\Admin\AppData\Local\Temp\OUninstall_x64.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall_x64.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall_x64.exe"3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:5732
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5516
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:2840
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:5188
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2952
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4632
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4804
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5292
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5172
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:1904
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5924
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:3092
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:1844
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:776
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5808
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:5544
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5944
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:3880
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:1296
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4588
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5144
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:2072
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:1696
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4984
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4556
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4524
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:2060
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3176
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:2860
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:2196
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3236
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:1228
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\OffScrubC2R\ScrubRetValFile.txt
- Size 24B
- SHA256 44119689fd681e69b50ff356faccd21bc3dfba827564dc1540910e7ee4fed75e
- MD5 07ddc9b29e487769e638da3e8277818e
- SHA1 8b414f25590ec81f94d3b30a31ac0cef49ff4db1
- SHA512 69ba8f825bc0cb8f1953df600d64794c4c4bbfad9e4303348c3e37dd66d8dd88c913df63bbc69a370cf7d2add22934da47760985c64c9a773d2d20bc2515ff49
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs
- Size 163KB
- SHA256 ff40619539bcfb5340d2a33dbc1a1e7b80c68e2c1e10c2aa4ca4a44087962098
- MD5 3103cf4c375a9c190ba59bc28e63b42a
- SHA1 a86ec75f582dff02676a7a859a93e9bbb89e8205
- SHA512 401640eed069c95d30f3f4b904c9e6e836015a4077b3abfe4c766910b356dcaabfdfd965daa31458b374daca3e8c616138e347201a786eace255e0b9cf2f17f4
- SSDEEP 1536:yrXgfa9I8Lk4f7tAtwr9pBrMujLXXHjlmOzz2ZN4OZ7:8gfa9I8LkKCOjBrMu3XXHjlNzmZ7
- TLSH T1D0F3D503BF4352359470D242AC3ADC6BFBAA1A5F90160518F98DB0511F7A69F81FD2EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\Uninstall.xml
- Size 59B
- SHA256 09d5b42140bab13165ba97fbd0e77792304c3c93555be02c3dce21a7a69c66dd
- MD5 364f86f97324ea82fe0d142cd01cf6dd
- SHA1 fc2a45da2ede0c018ab8e46044e6a25765c27d99
- SHA512 9b0a0944535e25c944e01bed1674efff119505292b176287c0dad3db70ffc4244cff21cccfd1fd94b09dd6d5f84221930b66b210101e482cc4bb5df3311a5fdf
- TLSH T1C3A0028720200D07B1570357C4AB1008F9301721C11C115CE06E3633152913C5352001
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\files.exe
- Size 765KB
- SHA256 4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e
- MD5 bb5569b15d68c10b7ff2d96b45825120
- SHA1 d6d2ed450aae4552f550f59bffe3dd42d8377835
- SHA512 640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957
- SSDEEP 12288:qXRqml2fcarViUC6TViXyKxhqahbqiR6WEttE6iITi44eKwV3uSI:ygEGcarV7CqViXtxAadq/WEtO8O/en9S
- TLSH T1C2F402313AE6C2BBD643123185CCBBB5B1EA97490F1528C323D4CF1D6F798A6D239919
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x64\cleanospp.exe
- Size 28KB
- SHA256 edf85f4e2ef1a427b34265a22f261d664ec78de90c3b5da4174ef28558c8522a
- MD5 d3467cb7b83b654c2d05407dc7ba2360
- SHA1 af7b4fdde21434f9e8d2e90fbff7b1d64af8a0a3
- SHA512 0998bc55b4b928077144cececfaaeee6d957f5acfcfab083987b2ba1e039ca9bf2156c633213c8a3c1ccd874d6ea31e5e1b8e0de6fdfd42693f844aca4408c5e
- SSDEEP 384:AQAInWKpEFFzpjq37oIOU6GHq33QPiu431VPjdOKV1TQilrkK:AxWTpOFagUb2qiu43P7PV1D
- TLSH T14FD218A00FF900D2E177FA70CBB48916ED35F99629319A5F1591C5440E33B82FF26B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x64\msvcr100.dll
- Size 809KB
- SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
- MD5 df3ca8d16bded6a54977b30e66864d33
- SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
- SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
- SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
- TLSH T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x86\cleanospp.exe
- Size 25KB
- SHA256 04ba4487f95290e0b0557b44300c18f637fbaf0872ee96e3111013b8a1539f25
- MD5 98821a7a5737d656633d10a3afb724bd
- SHA1 0307ba03137de39735c6e5bde8afd22d5279f0f9
- SHA512 5e32cfa18cf6353bd36194ef9f00d0768fb5ec9723582d7ca72fcf60931ba08199d750270307e1c82adf57fb801855be6986f26e09b02aa7a5db74e95e3263ff
- SSDEEP 384:N9FuUOvAiG0gIVDKDYgmh02HPwzi3AnXdOKV1TE54UslGsGK3:wUAAYgmO21QXPV1Y1i3
- TLSH T168C249614FF80452E5B65EB05FF0C413BE3ABB962D718D5E565185040C22BC3EAB6F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x86\msvcr100.dll
- Size 755KB
- SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
- MD5 bf38660a9125935658cfa3e53fdc7d65
- SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
- SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
- SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
- TLSH T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH