Overview
overview
7Static
static
5OUninstall.exe
windows10-2004-x64
7OUninstall.exe
windows11-ltsc_2024-x64
7OUninstall_x64.exe
windows10-2004-x64
7OUninstall_x64.exe
windows11-ltsc_2024-x64
7윈도우 ...IO.cmd
windows10-2004-x64
4윈도우 ...IO.cmd
windows11-ltsc_2024-x64
4윈도우�...5p.exe
windows10-2004-x64
5윈도우�...5p.exe
windows11-ltsc_2024-x64
5Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 13:28
Behavioral task
behavioral1
Sample
OUninstall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
OUninstall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
OUninstall_x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
OUninstall_x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
윈도우 오피스 인증툴 MAS/Microsoft-Activation-Scripts-master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
윈도우설치 루퍼스 4.15/rufus-4.15p.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target OUninstall_x64.exe
- Size 3.1MB
- Sample261024-qqwffsh191
- SHA256 17aa3a2e186c1a625a9e337defea3b65c820dc1dfeb0eb289702e0cc95bb3578
- MD5 e896a7c8d331c1e2e317f9a3cd0bb227
- SHA1 aee3ae0b7acffc57694009a0ff1880ac3015dad3
- SHA512 b48a9ab553b5a3ced79908ca2cb02163275694c14ab3530ebe53d00b2b20491ef9b89ad8a29d7ede7fefccb91b5f5c36cf7b7ad8ed2e8de4e7a7e65fb604aed6
- SSDEEP 24576:ZOFzXVDZq6FJ3/rWganJ/sJpORXy0BoJ0CpYo0NBbeGaD+wcvDpYbgEGcarV7CqJ:ur4Uxe456cRQiaccMkItxNs+Ebuen9c
- TLSH T17AE5B7106BF90118F2B3EA74D9764125CA3779565A35CA4E218C0ACE1F77980C9FFB3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4240 files.exe 248 files.exe 2436 files.exe 948 files.exe 1976 files.exe 4424 files.exe 1500 files.exe 120 files.exe 4196 files.exe 5680 files.exe 2028 files.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 11 IoCs
pid Process 3900 cscript.exe 5320 cscript.exe 2056 cscript.exe 5164 cscript.exe 3436 cscript.exe 5236 cscript.exe 4500 cscript.exe 2824 cscript.exe 2732 cscript.exe 2796 cscript.exe 5816 cscript.exe - Executes a command shell one-liner 1 TTPs 12 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4656 cmd.exe 2164 cmd.exe 4328 cmd.exe 2448 cmd.exe 2348 cmd.exe 5744 cmd.exe 3420 cmd.exe 1724 cmd.exe 4640 cmd.exe 4856 cmd.exe 4624 cmd.exe 4848 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cscript.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4452 WMIC.exe 4452 WMIC.exe 4452 WMIC.exe 4452 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4452 WMIC.exe Token: SeSecurityPrivilege 4452 WMIC.exe Token: SeTakeOwnershipPrivilege 4452 WMIC.exe Token: SeLoadDriverPrivilege 4452 WMIC.exe Token: SeSystemProfilePrivilege 4452 WMIC.exe Token: SeSystemtimePrivilege 4452 WMIC.exe Token: SeProfSingleProcessPrivilege 4452 WMIC.exe Token: SeIncBasePriorityPrivilege 4452 WMIC.exe Token: SeCreatePagefilePrivilege 4452 WMIC.exe Token: SeBackupPrivilege 4452 WMIC.exe Token: SeRestorePrivilege 4452 WMIC.exe Token: SeShutdownPrivilege 4452 WMIC.exe Token: SeDebugPrivilege 4452 WMIC.exe Token: SeSystemEnvironmentPrivilege 4452 WMIC.exe Token: SeRemoteShutdownPrivilege 4452 WMIC.exe Token: SeUndockPrivilege 4452 WMIC.exe Token: SeManageVolumePrivilege 4452 WMIC.exe Token: 33 4452 WMIC.exe Token: 34 4452 WMIC.exe Token: 35 4452 WMIC.exe Token: 36 4452 WMIC.exe Token: SeIncreaseQuotaPrivilege 4452 WMIC.exe Token: SeSecurityPrivilege 4452 WMIC.exe Token: SeTakeOwnershipPrivilege 4452 WMIC.exe Token: SeLoadDriverPrivilege 4452 WMIC.exe Token: SeSystemProfilePrivilege 4452 WMIC.exe Token: SeSystemtimePrivilege 4452 WMIC.exe Token: SeProfSingleProcessPrivilege 4452 WMIC.exe Token: SeIncBasePriorityPrivilege 4452 WMIC.exe Token: SeCreatePagefilePrivilege 4452 WMIC.exe Token: SeBackupPrivilege 4452 WMIC.exe Token: SeRestorePrivilege 4452 WMIC.exe Token: SeShutdownPrivilege 4452 WMIC.exe Token: SeDebugPrivilege 4452 WMIC.exe Token: SeSystemEnvironmentPrivilege 4452 WMIC.exe Token: SeRemoteShutdownPrivilege 4452 WMIC.exe Token: SeUndockPrivilege 4452 WMIC.exe Token: SeManageVolumePrivilege 4452 WMIC.exe Token: 33 4452 WMIC.exe Token: 34 4452 WMIC.exe Token: 35 4452 WMIC.exe Token: 36 4452 WMIC.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe 5856 OUninstall_x64.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 5856 wrote to memory of 4640 5856 OUninstall_x64.exe 89 PID 4640 wrote to memory of 4452 4640 cmd.exe 91 PID 5856 wrote to memory of 5604 5856 OUninstall_x64.exe 93 PID 5856 wrote to memory of 4656 5856 OUninstall_x64.exe 95 PID 4656 wrote to memory of 4240 4656 cmd.exe 97 PID 5856 wrote to memory of 3900 5856 OUninstall_x64.exe 98 PID 5856 wrote to memory of 2428 5856 OUninstall_x64.exe 101 PID 5856 wrote to memory of 4856 5856 OUninstall_x64.exe 103 PID 4856 wrote to memory of 248 4856 cmd.exe 105 PID 5856 wrote to memory of 5236 5856 OUninstall_x64.exe 106 PID 5856 wrote to memory of 4088 5856 OUninstall_x64.exe 109 PID 5856 wrote to memory of 2164 5856 OUninstall_x64.exe 111 PID 2164 wrote to memory of 2436 2164 cmd.exe 113 PID 5856 wrote to memory of 5320 5856 OUninstall_x64.exe 114 PID 5856 wrote to memory of 2740 5856 OUninstall_x64.exe 116 PID 5856 wrote to memory of 4328 5856 OUninstall_x64.exe 118 PID 4328 wrote to memory of 948 4328 cmd.exe 120 PID 5856 wrote to memory of 2056 5856 OUninstall_x64.exe 121 PID 5856 wrote to memory of 5568 5856 OUninstall_x64.exe 123 PID 5856 wrote to memory of 4624 5856 OUninstall_x64.exe 125 PID 4624 wrote to memory of 1976 4624 cmd.exe 127 PID 5856 wrote to memory of 4500 5856 OUninstall_x64.exe 128 PID 5856 wrote to memory of 2224 5856 OUninstall_x64.exe 130 PID 5856 wrote to memory of 2448 5856 OUninstall_x64.exe 132 PID 2448 wrote to memory of 4424 2448 cmd.exe 134 PID 5856 wrote to memory of 2824 5856 OUninstall_x64.exe 135 PID 5856 wrote to memory of 2396 5856 OUninstall_x64.exe 137 PID 5856 wrote to memory of 4848 5856 OUninstall_x64.exe 139 PID 4848 wrote to memory of 1500 4848 cmd.exe 141 PID 5856 wrote to memory of 2732 5856 OUninstall_x64.exe 142 PID 5856 wrote to memory of 108 5856 OUninstall_x64.exe 144 PID 5856 wrote to memory of 2348 5856 OUninstall_x64.exe 146 PID 2348 wrote to memory of 120 2348 cmd.exe 148 PID 5856 wrote to memory of 5164 5856 OUninstall_x64.exe 149 PID 5856 wrote to memory of 5416 5856 OUninstall_x64.exe 151 PID 5856 wrote to memory of 5744 5856 OUninstall_x64.exe 153 PID 5744 wrote to memory of 4196 5744 cmd.exe 155 PID 5856 wrote to memory of 2796 5856 OUninstall_x64.exe 156 PID 5856 wrote to memory of 4824 5856 OUninstall_x64.exe 158 PID 5856 wrote to memory of 3420 5856 OUninstall_x64.exe 160 PID 3420 wrote to memory of 5680 3420 cmd.exe 162 PID 5856 wrote to memory of 3436 5856 OUninstall_x64.exe 163 PID 5856 wrote to memory of 1684 5856 OUninstall_x64.exe 165 PID 5856 wrote to memory of 1724 5856 OUninstall_x64.exe 167 PID 1724 wrote to memory of 2028 1724 cmd.exe 169 PID 5856 wrote to memory of 5816 5856 OUninstall_x64.exe 170
Processes
-
C:\Users\Admin\AppData\Local\Temp\OUninstall_x64.exe"C:\Users\Admin\AppData\Local\Temp\OUninstall_x64.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall_x64.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall_x64.exe"3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:5604
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4240
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:3900
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:2428
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:248
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5236
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4088
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2436
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5320
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:2740
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:948
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:2056
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:5568
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1976
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4500
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:2224
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4424
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:2824
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:2396
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1500
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:2732
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:108
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:120
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5164
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:5416
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:2796
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:4824
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5680
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:3436
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:1684
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c files.exe -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\files\files.exefiles.exe -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE 2>&12⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5816
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\OffScrubC2R\ScrubRetValFile.txt
- Size 24B
- SHA256 44119689fd681e69b50ff356faccd21bc3dfba827564dc1540910e7ee4fed75e
- MD5 07ddc9b29e487769e638da3e8277818e
- SHA1 8b414f25590ec81f94d3b30a31ac0cef49ff4db1
- SHA512 69ba8f825bc0cb8f1953df600d64794c4c4bbfad9e4303348c3e37dd66d8dd88c913df63bbc69a370cf7d2add22934da47760985c64c9a773d2d20bc2515ff49
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs
- Size 163KB
- SHA256 ff40619539bcfb5340d2a33dbc1a1e7b80c68e2c1e10c2aa4ca4a44087962098
- MD5 3103cf4c375a9c190ba59bc28e63b42a
- SHA1 a86ec75f582dff02676a7a859a93e9bbb89e8205
- SHA512 401640eed069c95d30f3f4b904c9e6e836015a4077b3abfe4c766910b356dcaabfdfd965daa31458b374daca3e8c616138e347201a786eace255e0b9cf2f17f4
- SSDEEP 1536:yrXgfa9I8Lk4f7tAtwr9pBrMujLXXHjlmOzz2ZN4OZ7:8gfa9I8LkKCOjBrMu3XXHjlNzmZ7
- TLSH T1D0F3D503BF4352359470D242AC3ADC6BFBAA1A5F90160518F98DB0511F7A69F81FD2EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\Uninstall.xml
- Size 59B
- SHA256 09d5b42140bab13165ba97fbd0e77792304c3c93555be02c3dce21a7a69c66dd
- MD5 364f86f97324ea82fe0d142cd01cf6dd
- SHA1 fc2a45da2ede0c018ab8e46044e6a25765c27d99
- SHA512 9b0a0944535e25c944e01bed1674efff119505292b176287c0dad3db70ffc4244cff21cccfd1fd94b09dd6d5f84221930b66b210101e482cc4bb5df3311a5fdf
- TLSH T1C3A0028720200D07B1570357C4AB1008F9301721C11C115CE06E3633152913C5352001
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\files.exe
- Size 765KB
- SHA256 4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e
- MD5 bb5569b15d68c10b7ff2d96b45825120
- SHA1 d6d2ed450aae4552f550f59bffe3dd42d8377835
- SHA512 640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957
- SSDEEP 12288:qXRqml2fcarViUC6TViXyKxhqahbqiR6WEttE6iITi44eKwV3uSI:ygEGcarV7CqViXtxAadq/WEtO8O/en9S
- TLSH T1C2F402313AE6C2BBD643123185CCBBB5B1EA97490F1528C323D4CF1D6F798A6D239919
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x64\cleanospp.exe
- Size 28KB
- SHA256 edf85f4e2ef1a427b34265a22f261d664ec78de90c3b5da4174ef28558c8522a
- MD5 d3467cb7b83b654c2d05407dc7ba2360
- SHA1 af7b4fdde21434f9e8d2e90fbff7b1d64af8a0a3
- SHA512 0998bc55b4b928077144cececfaaeee6d957f5acfcfab083987b2ba1e039ca9bf2156c633213c8a3c1ccd874d6ea31e5e1b8e0de6fdfd42693f844aca4408c5e
- SSDEEP 384:AQAInWKpEFFzpjq37oIOU6GHq33QPiu431VPjdOKV1TQilrkK:AxWTpOFagUb2qiu43P7PV1D
- TLSH T14FD218A00FF900D2E177FA70CBB48916ED35F99629319A5F1591C5440E33B82FF26B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x64\msvcr100.dll
- Size 809KB
- SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
- MD5 df3ca8d16bded6a54977b30e66864d33
- SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
- SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
- SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
- TLSH T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x86\cleanospp.exe
- Size 25KB
- SHA256 04ba4487f95290e0b0557b44300c18f637fbaf0872ee96e3111013b8a1539f25
- MD5 98821a7a5737d656633d10a3afb724bd
- SHA1 0307ba03137de39735c6e5bde8afd22d5279f0f9
- SHA512 5e32cfa18cf6353bd36194ef9f00d0768fb5ec9723582d7ca72fcf60931ba08199d750270307e1c82adf57fb801855be6986f26e09b02aa7a5db74e95e3263ff
- SSDEEP 384:N9FuUOvAiG0gIVDKDYgmh02HPwzi3AnXdOKV1TE54UslGsGK3:wUAAYgmO21QXPV1Y1i3
- TLSH T168C249614FF80452E5B65EB05FF0C413BE3ABB962D718D5E565185040C22BC3EAB6F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\x86\msvcr100.dll
- Size 755KB
- SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
- MD5 bf38660a9125935658cfa3e53fdc7d65
- SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
- SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
- SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
- TLSH T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH