IOC Report
invoice.exe

invoice.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\ProgramData\HostData\logs.uce

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\RarSFX0\4usfliof.exe

PE32 executable (console) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\RarSFX0\yee9mbi69cm7.exe

PE32 executable (console) Intel 80386, for MS Windows

dropped

C:\Users\user\Desktop\invoice.exe

"C:\Users\user\Desktop\invoice.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\Setup.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c dir /b "*.exe"

C:\Users\user\AppData\Local\Temp\RarSFX0\4usfliof.exe

"4usfliof.exe"

C:\Users\user\AppData\Local\Temp\RarSFX0\yee9mbi69cm7.exe

"yee9mbi69cm7.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C powershell -EncodedCommand "PAAjADUASwBtAHMAOAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcASAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBjAGwASgBhADgAYwBqADkAWgAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB0AFcAQwAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off