703aadea111eae71a7dfb3f2c63c4522b4edd138033fef221295f74d3509e10a

Analysis

max time kernel
136s
max time network
147s
platform
windows10_x64
resource
win10
submitted
26/10/2020, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INV-009484_PDF.exe
Size 1.0MB
Sample201026-awkzyzcwls
SHA256 703aadea111eae71a7dfb3f2c63c4522b4edd138033fef221295f74d3509e10a
MD5 c70bd03807471d22071110f5179bddc9
SHA1 5d8825e7344a3c925f22d0fe2a2955f9c2632d78
SHA512 38a5437d6f63cdccf57be5636022939702cf9d2507dd55dc730a8af8eef5220aa1bbd316cc06945ece2cb03f4a30f6a47845a8084ba34d69da9ae95ff78a3c6d
MD5 SHA1 SHA512

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
3884	INV-009484_PDF.exe
3884	INV-009484_PDF.exe
3884	INV-009484_PDF.exe
3884	INV-009484_PDF.exe
3884	INV-009484_PDF.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3884 set thread context of 1952	3884	INV-009484_PDF.exe	74

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	3884	WerFault.exe	67

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\ms-settings\shell\open\command	INV-009484_PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\ms-settings	INV-009484_PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\ms-settings\shell	INV-009484_PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\ms-settings\shell\open	INV-009484_PDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\ms-settings\shell\open\command\	INV-009484_PDF.exe

Suspicious behavior: EnumeratesProcesses 83 IoCs

pid	Process
3884	INV-009484_PDF.exe
3884	INV-009484_PDF.exe
3884	INV-009484_PDF.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe
3472	powershell.exe
3472	powershell.exe
3472	powershell.exe
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2088	powershell.exe
2088	powershell.exe
2088	powershell.exe
3668	powershell.exe
3668	powershell.exe
3668	powershell.exe
2700	powershell.exe
2700	powershell.exe
2700	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
1220	powershell.exe
1220	powershell.exe
1220	powershell.exe
3692	powershell.exe
3692	powershell.exe
3692	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
2820	powershell.exe
2820	powershell.exe
2820	powershell.exe
3120	powershell.exe
3120	powershell.exe
3120	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
572	powershell.exe
572	powershell.exe
572	powershell.exe
856	powershell.exe
856	powershell.exe
856	powershell.exe
576	powershell.exe
576	powershell.exe
576	powershell.exe
3900	powershell.exe
3900	powershell.exe
3900	powershell.exe
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe
188	powershell.exe
188	powershell.exe
188	powershell.exe
2260	powershell.exe
2260	powershell.exe
2260	powershell.exe

Suspicious use of AdjustPrivilegeToken 280 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	INV-009484_PDF.exe
Token: SeRestorePrivilege	2668	WerFault.exe
Token: SeBackupPrivilege	2668	WerFault.exe
Token: SeDebugPrivilege	2668	WerFault.exe
Token: SeDebugPrivilege	1952	INV-009484_PDF.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeIncreaseQuotaPrivilege	3192	powershell.exe
Token: SeSecurityPrivilege	3192	powershell.exe
Token: SeTakeOwnershipPrivilege	3192	powershell.exe
Token: SeLoadDriverPrivilege	3192	powershell.exe
Token: SeSystemProfilePrivilege	3192	powershell.exe
Token: SeSystemtimePrivilege	3192	powershell.exe
Token: SeProfSingleProcessPrivilege	3192	powershell.exe
Token: SeIncBasePriorityPrivilege	3192	powershell.exe
Token: SeCreatePagefilePrivilege	3192	powershell.exe
Token: SeBackupPrivilege	3192	powershell.exe
Token: SeRestorePrivilege	3192	powershell.exe
Token: SeShutdownPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeSystemEnvironmentPrivilege	3192	powershell.exe
Token: SeRemoteShutdownPrivilege	3192	powershell.exe
Token: SeUndockPrivilege	3192	powershell.exe
Token: SeManageVolumePrivilege	3192	powershell.exe
Token: 33	3192	powershell.exe
Token: 34	3192	powershell.exe
Token: 35	3192	powershell.exe
Token: 36	3192	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeIncreaseQuotaPrivilege	3472	powershell.exe
Token: SeSecurityPrivilege	3472	powershell.exe
Token: SeTakeOwnershipPrivilege	3472	powershell.exe
Token: SeLoadDriverPrivilege	3472	powershell.exe
Token: SeSystemProfilePrivilege	3472	powershell.exe
Token: SeSystemtimePrivilege	3472	powershell.exe
Token: SeProfSingleProcessPrivilege	3472	powershell.exe
Token: SeIncBasePriorityPrivilege	3472	powershell.exe
Token: SeCreatePagefilePrivilege	3472	powershell.exe
Token: SeBackupPrivilege	3472	powershell.exe
Token: SeRestorePrivilege	3472	powershell.exe
Token: SeShutdownPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeSystemEnvironmentPrivilege	3472	powershell.exe
Token: SeRemoteShutdownPrivilege	3472	powershell.exe
Token: SeUndockPrivilege	3472	powershell.exe
Token: SeManageVolumePrivilege	3472	powershell.exe
Token: 33	3472	powershell.exe
Token: 34	3472	powershell.exe
Token: 35	3472	powershell.exe
Token: 36	3472	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeIncreaseQuotaPrivilege	1176	powershell.exe
Token: SeSecurityPrivilege	1176	powershell.exe
Token: SeTakeOwnershipPrivilege	1176	powershell.exe
Token: SeLoadDriverPrivilege	1176	powershell.exe
Token: SeSystemProfilePrivilege	1176	powershell.exe
Token: SeSystemtimePrivilege	1176	powershell.exe
Token: SeProfSingleProcessPrivilege	1176	powershell.exe
Token: SeIncBasePriorityPrivilege	1176	powershell.exe
Token: SeCreatePagefilePrivilege	1176	powershell.exe
Token: SeBackupPrivilege	1176	powershell.exe
Token: SeRestorePrivilege	1176	powershell.exe
Token: SeShutdownPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeSystemEnvironmentPrivilege	1176	powershell.exe
Token: SeRemoteShutdownPrivilege	1176	powershell.exe
Token: SeUndockPrivilege	1176	powershell.exe
Token: SeManageVolumePrivilege	1176	powershell.exe
Token: 33	1176	powershell.exe
Token: 34	1176	powershell.exe
Token: 35	1176	powershell.exe
Token: 36	1176	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeIncreaseQuotaPrivilege	2172	powershell.exe
Token: SeSecurityPrivilege	2172	powershell.exe
Token: SeTakeOwnershipPrivilege	2172	powershell.exe
Token: SeLoadDriverPrivilege	2172	powershell.exe
Token: SeSystemProfilePrivilege	2172	powershell.exe
Token: SeSystemtimePrivilege	2172	powershell.exe
Token: SeProfSingleProcessPrivilege	2172	powershell.exe
Token: SeIncBasePriorityPrivilege	2172	powershell.exe
Token: SeCreatePagefilePrivilege	2172	powershell.exe
Token: SeBackupPrivilege	2172	powershell.exe
Token: SeRestorePrivilege	2172	powershell.exe
Token: SeShutdownPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeSystemEnvironmentPrivilege	2172	powershell.exe
Token: SeRemoteShutdownPrivilege	2172	powershell.exe
Token: SeUndockPrivilege	2172	powershell.exe
Token: SeManageVolumePrivilege	2172	powershell.exe
Token: 33	2172	powershell.exe
Token: 34	2172	powershell.exe
Token: 35	2172	powershell.exe
Token: 36	2172	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeIncreaseQuotaPrivilege	2088	powershell.exe
Token: SeSecurityPrivilege	2088	powershell.exe
Token: SeTakeOwnershipPrivilege	2088	powershell.exe
Token: SeLoadDriverPrivilege	2088	powershell.exe
Token: SeSystemProfilePrivilege	2088	powershell.exe
Token: SeSystemtimePrivilege	2088	powershell.exe
Token: SeProfSingleProcessPrivilege	2088	powershell.exe
Token: SeIncBasePriorityPrivilege	2088	powershell.exe
Token: SeCreatePagefilePrivilege	2088	powershell.exe
Token: SeBackupPrivilege	2088	powershell.exe
Token: SeRestorePrivilege	2088	powershell.exe
Token: SeShutdownPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeSystemEnvironmentPrivilege	2088	powershell.exe
Token: SeRemoteShutdownPrivilege	2088	powershell.exe
Token: SeUndockPrivilege	2088	powershell.exe
Token: SeManageVolumePrivilege	2088	powershell.exe
Token: 33	2088	powershell.exe
Token: 34	2088	powershell.exe
Token: 35	2088	powershell.exe
Token: 36	2088	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeIncreaseQuotaPrivilege	3668	powershell.exe
Token: SeSecurityPrivilege	3668	powershell.exe
Token: SeTakeOwnershipPrivilege	3668	powershell.exe
Token: SeLoadDriverPrivilege	3668	powershell.exe
Token: SeSystemProfilePrivilege	3668	powershell.exe
Token: SeSystemtimePrivilege	3668	powershell.exe
Token: SeProfSingleProcessPrivilege	3668	powershell.exe
Token: SeIncBasePriorityPrivilege	3668	powershell.exe
Token: SeCreatePagefilePrivilege	3668	powershell.exe
Token: SeBackupPrivilege	3668	powershell.exe
Token: SeRestorePrivilege	3668	powershell.exe
Token: SeShutdownPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeSystemEnvironmentPrivilege	3668	powershell.exe
Token: SeRemoteShutdownPrivilege	3668	powershell.exe
Token: SeUndockPrivilege	3668	powershell.exe
Token: SeManageVolumePrivilege	3668	powershell.exe
Token: 33	3668	powershell.exe
Token: 34	3668	powershell.exe
Token: 35	3668	powershell.exe
Token: 36	3668	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeIncreaseQuotaPrivilege	2700	powershell.exe
Token: SeSecurityPrivilege	2700	powershell.exe
Token: SeTakeOwnershipPrivilege	2700	powershell.exe
Token: SeLoadDriverPrivilege	2700	powershell.exe
Token: SeSystemProfilePrivilege	2700	powershell.exe
Token: SeSystemtimePrivilege	2700	powershell.exe
Token: SeProfSingleProcessPrivilege	2700	powershell.exe
Token: SeIncBasePriorityPrivilege	2700	powershell.exe
Token: SeCreatePagefilePrivilege	2700	powershell.exe
Token: SeBackupPrivilege	2700	powershell.exe
Token: SeRestorePrivilege	2700	powershell.exe
Token: SeShutdownPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeSystemEnvironmentPrivilege	2700	powershell.exe
Token: SeRemoteShutdownPrivilege	2700	powershell.exe
Token: SeUndockPrivilege	2700	powershell.exe
Token: SeManageVolumePrivilege	2700	powershell.exe
Token: 33	2700	powershell.exe
Token: 34	2700	powershell.exe
Token: 35	2700	powershell.exe
Token: 36	2700	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeIncreaseQuotaPrivilege	2060	powershell.exe
Token: SeSecurityPrivilege	2060	powershell.exe
Token: SeTakeOwnershipPrivilege	2060	powershell.exe
Token: SeLoadDriverPrivilege	2060	powershell.exe
Token: SeSystemProfilePrivilege	2060	powershell.exe
Token: SeSystemtimePrivilege	2060	powershell.exe
Token: SeProfSingleProcessPrivilege	2060	powershell.exe
Token: SeIncBasePriorityPrivilege	2060	powershell.exe
Token: SeCreatePagefilePrivilege	2060	powershell.exe
Token: SeBackupPrivilege	2060	powershell.exe
Token: SeRestorePrivilege	2060	powershell.exe
Token: SeShutdownPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeSystemEnvironmentPrivilege	2060	powershell.exe
Token: SeRemoteShutdownPrivilege	2060	powershell.exe
Token: SeUndockPrivilege	2060	powershell.exe
Token: SeManageVolumePrivilege	2060	powershell.exe
Token: 33	2060	powershell.exe
Token: 34	2060	powershell.exe
Token: 35	2060	powershell.exe
Token: 36	2060	powershell.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeIncreaseQuotaPrivilege	1220	powershell.exe
Token: SeSecurityPrivilege	1220	powershell.exe
Token: SeTakeOwnershipPrivilege	1220	powershell.exe
Token: SeLoadDriverPrivilege	1220	powershell.exe
Token: SeSystemProfilePrivilege	1220	powershell.exe
Token: SeSystemtimePrivilege	1220	powershell.exe
Token: SeProfSingleProcessPrivilege	1220	powershell.exe
Token: SeIncBasePriorityPrivilege	1220	powershell.exe
Token: SeCreatePagefilePrivilege	1220	powershell.exe
Token: SeBackupPrivilege	1220	powershell.exe
Token: SeRestorePrivilege	1220	powershell.exe
Token: SeShutdownPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeSystemEnvironmentPrivilege	1220	powershell.exe
Token: SeRemoteShutdownPrivilege	1220	powershell.exe
Token: SeUndockPrivilege	1220	powershell.exe
Token: SeManageVolumePrivilege	1220	powershell.exe
Token: 33	1220	powershell.exe
Token: 34	1220	powershell.exe
Token: 35	1220	powershell.exe
Token: 36	1220	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeIncreaseQuotaPrivilege	3692	powershell.exe
Token: SeSecurityPrivilege	3692	powershell.exe
Token: SeTakeOwnershipPrivilege	3692	powershell.exe
Token: SeLoadDriverPrivilege	3692	powershell.exe
Token: SeSystemProfilePrivilege	3692	powershell.exe
Token: SeSystemtimePrivilege	3692	powershell.exe
Token: SeProfSingleProcessPrivilege	3692	powershell.exe
Token: SeIncBasePriorityPrivilege	3692	powershell.exe
Token: SeCreatePagefilePrivilege	3692	powershell.exe
Token: SeBackupPrivilege	3692	powershell.exe
Token: SeRestorePrivilege	3692	powershell.exe
Token: SeShutdownPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeSystemEnvironmentPrivilege	3692	powershell.exe
Token: SeRemoteShutdownPrivilege	3692	powershell.exe
Token: SeUndockPrivilege	3692	powershell.exe
Token: SeManageVolumePrivilege	3692	powershell.exe
Token: 33	3692	powershell.exe
Token: 34	3692	powershell.exe
Token: 35	3692	powershell.exe
Token: 36	3692	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeIncreaseQuotaPrivilege	3900	powershell.exe
Token: SeSecurityPrivilege	3900	powershell.exe
Token: SeTakeOwnershipPrivilege	3900	powershell.exe
Token: SeLoadDriverPrivilege	3900	powershell.exe
Token: SeSystemProfilePrivilege	3900	powershell.exe
Token: SeSystemtimePrivilege	3900	powershell.exe
Token: SeProfSingleProcessPrivilege	3900	powershell.exe
Token: SeIncBasePriorityPrivilege	3900	powershell.exe
Token: SeCreatePagefilePrivilege	3900	powershell.exe
Token: SeBackupPrivilege	3900	powershell.exe
Token: SeRestorePrivilege	3900	powershell.exe
Token: SeShutdownPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeSystemEnvironmentPrivilege	3900	powershell.exe
Token: SeRemoteShutdownPrivilege	3900	powershell.exe
Token: SeUndockPrivilege	3900	powershell.exe
Token: SeManageVolumePrivilege	3900	powershell.exe
Token: 33	3900	powershell.exe
Token: 34	3900	powershell.exe
Token: 35	3900	powershell.exe
Token: 36	3900	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeIncreaseQuotaPrivilege	3244	powershell.exe
Token: SeSecurityPrivilege	3244	powershell.exe
Token: SeTakeOwnershipPrivilege	3244	powershell.exe
Token: SeLoadDriverPrivilege	3244	powershell.exe
Token: SeSystemProfilePrivilege	3244	powershell.exe
Token: SeSystemtimePrivilege	3244	powershell.exe
Token: SeProfSingleProcessPrivilege	3244	powershell.exe
Token: SeIncBasePriorityPrivilege	3244	powershell.exe
Token: SeCreatePagefilePrivilege	3244	powershell.exe
Token: SeBackupPrivilege	3244	powershell.exe
Token: SeRestorePrivilege	3244	powershell.exe
Token: SeShutdownPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeSystemEnvironmentPrivilege	3244	powershell.exe
Token: SeRemoteShutdownPrivilege	3244	powershell.exe
Token: SeUndockPrivilege	3244	powershell.exe
Token: SeManageVolumePrivilege	3244	powershell.exe
Token: 33	3244	powershell.exe
Token: 34	3244	powershell.exe
Token: 35	3244	powershell.exe
Token: 36	3244	powershell.exe
Token: SeDebugPrivilege	188	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe

Suspicious use of WriteProcessMemory 215 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1952	3884	INV-009484_PDF.exe	74
PID 3884 wrote to memory of 1952	3884	INV-009484_PDF.exe	74
PID 3884 wrote to memory of 1952	3884	INV-009484_PDF.exe	74
PID 3884 wrote to memory of 1952	3884	INV-009484_PDF.exe	74
PID 3884 wrote to memory of 1952	3884	INV-009484_PDF.exe	74
PID 3884 wrote to memory of 1952	3884	INV-009484_PDF.exe	74
PID 3884 wrote to memory of 1952	3884	INV-009484_PDF.exe	74
PID 3884 wrote to memory of 1952	3884	INV-009484_PDF.exe	74
PID 1952 wrote to memory of 1388	1952	INV-009484_PDF.exe	79
PID 1952 wrote to memory of 1388	1952	INV-009484_PDF.exe	79
PID 1952 wrote to memory of 1388	1952	INV-009484_PDF.exe	79
PID 1388 wrote to memory of 1976	1388	cmd.exe	81
PID 1388 wrote to memory of 1976	1388	cmd.exe	81
PID 1388 wrote to memory of 1976	1388	cmd.exe	81
PID 1952 wrote to memory of 2816	1952	INV-009484_PDF.exe	82
PID 1952 wrote to memory of 2816	1952	INV-009484_PDF.exe	82
PID 1952 wrote to memory of 2816	1952	INV-009484_PDF.exe	82
PID 2816 wrote to memory of 3264	2816	cmd.exe	84
PID 2816 wrote to memory of 3264	2816	cmd.exe	84
PID 2816 wrote to memory of 3264	2816	cmd.exe	84
PID 1952 wrote to memory of 2180	1952	INV-009484_PDF.exe	86
PID 1952 wrote to memory of 2180	1952	INV-009484_PDF.exe	86
PID 1952 wrote to memory of 2180	1952	INV-009484_PDF.exe	86
PID 2180 wrote to memory of 4044	2180	cmd.exe	88
PID 2180 wrote to memory of 4044	2180	cmd.exe	88
PID 2180 wrote to memory of 4044	2180	cmd.exe	88
PID 1952 wrote to memory of 1736	1952	INV-009484_PDF.exe	89
PID 1952 wrote to memory of 1736	1952	INV-009484_PDF.exe	89
PID 1952 wrote to memory of 1736	1952	INV-009484_PDF.exe	89
PID 1736 wrote to memory of 2328	1736	cmd.exe	91
PID 1736 wrote to memory of 2328	1736	cmd.exe	91
PID 1736 wrote to memory of 2328	1736	cmd.exe	91
PID 1952 wrote to memory of 200	1952	INV-009484_PDF.exe	92
PID 1952 wrote to memory of 200	1952	INV-009484_PDF.exe	92
PID 1952 wrote to memory of 200	1952	INV-009484_PDF.exe	92
PID 200 wrote to memory of 3420	200	cmd.exe	94
PID 200 wrote to memory of 3420	200	cmd.exe	94
PID 200 wrote to memory of 3420	200	cmd.exe	94
PID 1952 wrote to memory of 3888	1952	INV-009484_PDF.exe	95
PID 1952 wrote to memory of 3888	1952	INV-009484_PDF.exe	95
PID 1952 wrote to memory of 3888	1952	INV-009484_PDF.exe	95
PID 3888 wrote to memory of 3804	3888	cmd.exe	97
PID 3888 wrote to memory of 3804	3888	cmd.exe	97
PID 3888 wrote to memory of 3804	3888	cmd.exe	97
PID 1952 wrote to memory of 2156	1952	INV-009484_PDF.exe	98
PID 1952 wrote to memory of 2156	1952	INV-009484_PDF.exe	98
PID 1952 wrote to memory of 2156	1952	INV-009484_PDF.exe	98
PID 2156 wrote to memory of 3816	2156	cmd.exe	100
PID 2156 wrote to memory of 3816	2156	cmd.exe	100
PID 2156 wrote to memory of 3816	2156	cmd.exe	100
PID 1952 wrote to memory of 3116	1952	INV-009484_PDF.exe	101
PID 1952 wrote to memory of 3116	1952	INV-009484_PDF.exe	101
PID 1952 wrote to memory of 3116	1952	INV-009484_PDF.exe	101
PID 3116 wrote to memory of 1592	3116	cmd.exe	103
PID 3116 wrote to memory of 1592	3116	cmd.exe	103
PID 3116 wrote to memory of 1592	3116	cmd.exe	103
PID 1952 wrote to memory of 2612	1952	INV-009484_PDF.exe	104
PID 1952 wrote to memory of 2612	1952	INV-009484_PDF.exe	104
PID 1952 wrote to memory of 2612	1952	INV-009484_PDF.exe	104
PID 2612 wrote to memory of 3700	2612	cmd.exe	106
PID 2612 wrote to memory of 3700	2612	cmd.exe	106
PID 2612 wrote to memory of 3700	2612	cmd.exe	106
PID 1952 wrote to memory of 2988	1952	INV-009484_PDF.exe	107
PID 1952 wrote to memory of 2988	1952	INV-009484_PDF.exe	107
PID 1952 wrote to memory of 2988	1952	INV-009484_PDF.exe	107
PID 2988 wrote to memory of 3916	2988	cmd.exe	109
PID 2988 wrote to memory of 3916	2988	cmd.exe	109
PID 2988 wrote to memory of 3916	2988	cmd.exe	109
PID 1952 wrote to memory of 3992	1952	INV-009484_PDF.exe	110
PID 1952 wrote to memory of 3992	1952	INV-009484_PDF.exe	110
PID 1952 wrote to memory of 3992	1952	INV-009484_PDF.exe	110
PID 3992 wrote to memory of 212	3992	cmd.exe	112
PID 3992 wrote to memory of 212	3992	cmd.exe	112
PID 3992 wrote to memory of 212	3992	cmd.exe	112
PID 1952 wrote to memory of 492	1952	INV-009484_PDF.exe	113
PID 1952 wrote to memory of 492	1952	INV-009484_PDF.exe	113
PID 1952 wrote to memory of 492	1952	INV-009484_PDF.exe	113
PID 492 wrote to memory of 3192	492	cmd.exe	115
PID 492 wrote to memory of 3192	492	cmd.exe	115
PID 492 wrote to memory of 3192	492	cmd.exe	115
PID 1952 wrote to memory of 3188	1952	INV-009484_PDF.exe	116
PID 1952 wrote to memory of 3188	1952	INV-009484_PDF.exe	116
PID 1952 wrote to memory of 3188	1952	INV-009484_PDF.exe	116
PID 3188 wrote to memory of 3472	3188	cmd.exe	118
PID 3188 wrote to memory of 3472	3188	cmd.exe	118
PID 3188 wrote to memory of 3472	3188	cmd.exe	118
PID 1952 wrote to memory of 3464	1952	INV-009484_PDF.exe	119
PID 1952 wrote to memory of 3464	1952	INV-009484_PDF.exe	119
PID 1952 wrote to memory of 3464	1952	INV-009484_PDF.exe	119
PID 3464 wrote to memory of 1176	3464	cmd.exe	121
PID 3464 wrote to memory of 1176	3464	cmd.exe	121
PID 3464 wrote to memory of 1176	3464	cmd.exe	121
PID 1952 wrote to memory of 184	1952	INV-009484_PDF.exe	122
PID 1952 wrote to memory of 184	1952	INV-009484_PDF.exe	122
PID 1952 wrote to memory of 184	1952	INV-009484_PDF.exe	122
PID 184 wrote to memory of 2172	184	cmd.exe	124
PID 184 wrote to memory of 2172	184	cmd.exe	124
PID 184 wrote to memory of 2172	184	cmd.exe	124
PID 1952 wrote to memory of 3960	1952	INV-009484_PDF.exe	125
PID 1952 wrote to memory of 3960	1952	INV-009484_PDF.exe	125
PID 1952 wrote to memory of 3960	1952	INV-009484_PDF.exe	125
PID 3960 wrote to memory of 2088	3960	cmd.exe	127
PID 3960 wrote to memory of 2088	3960	cmd.exe	127
PID 3960 wrote to memory of 2088	3960	cmd.exe	127
PID 1952 wrote to memory of 2116	1952	INV-009484_PDF.exe	128
PID 1952 wrote to memory of 2116	1952	INV-009484_PDF.exe	128
PID 1952 wrote to memory of 2116	1952	INV-009484_PDF.exe	128
PID 2116 wrote to memory of 3668	2116	cmd.exe	130
PID 2116 wrote to memory of 3668	2116	cmd.exe	130
PID 2116 wrote to memory of 3668	2116	cmd.exe	130
PID 1952 wrote to memory of 2164	1952	INV-009484_PDF.exe	131
PID 1952 wrote to memory of 2164	1952	INV-009484_PDF.exe	131
PID 1952 wrote to memory of 2164	1952	INV-009484_PDF.exe	131
PID 2164 wrote to memory of 2700	2164	cmd.exe	133
PID 2164 wrote to memory of 2700	2164	cmd.exe	133
PID 2164 wrote to memory of 2700	2164	cmd.exe	133
PID 1952 wrote to memory of 2084	1952	INV-009484_PDF.exe	134
PID 1952 wrote to memory of 2084	1952	INV-009484_PDF.exe	134
PID 1952 wrote to memory of 2084	1952	INV-009484_PDF.exe	134
PID 2084 wrote to memory of 2060	2084	cmd.exe	136
PID 2084 wrote to memory of 2060	2084	cmd.exe	136
PID 2084 wrote to memory of 2060	2084	cmd.exe	136
PID 1952 wrote to memory of 3776	1952	INV-009484_PDF.exe	137
PID 1952 wrote to memory of 3776	1952	INV-009484_PDF.exe	137
PID 1952 wrote to memory of 3776	1952	INV-009484_PDF.exe	137
PID 3776 wrote to memory of 1220	3776	cmd.exe	139
PID 3776 wrote to memory of 1220	3776	cmd.exe	139
PID 3776 wrote to memory of 1220	3776	cmd.exe	139
PID 1952 wrote to memory of 3928	1952	INV-009484_PDF.exe	140
PID 1952 wrote to memory of 3928	1952	INV-009484_PDF.exe	140
PID 1952 wrote to memory of 3928	1952	INV-009484_PDF.exe	140
PID 3928 wrote to memory of 3692	3928	cmd.exe	142
PID 3928 wrote to memory of 3692	3928	cmd.exe	142
PID 3928 wrote to memory of 3692	3928	cmd.exe	142
PID 1952 wrote to memory of 1496	1952	INV-009484_PDF.exe	143
PID 1952 wrote to memory of 1496	1952	INV-009484_PDF.exe	143
PID 1952 wrote to memory of 1496	1952	INV-009484_PDF.exe	143
PID 1496 wrote to memory of 1580	1496	cmd.exe	145
PID 1496 wrote to memory of 1580	1496	cmd.exe	145
PID 1496 wrote to memory of 1580	1496	cmd.exe	145
PID 1952 wrote to memory of 3152	1952	INV-009484_PDF.exe	146
PID 1952 wrote to memory of 3152	1952	INV-009484_PDF.exe	146
PID 1952 wrote to memory of 3152	1952	INV-009484_PDF.exe	146
PID 3152 wrote to memory of 2820	3152	cmd.exe	148
PID 3152 wrote to memory of 2820	3152	cmd.exe	148
PID 3152 wrote to memory of 2820	3152	cmd.exe	148
PID 1952 wrote to memory of 1444	1952	INV-009484_PDF.exe	149
PID 1952 wrote to memory of 1444	1952	INV-009484_PDF.exe	149
PID 1952 wrote to memory of 1444	1952	INV-009484_PDF.exe	149
PID 1444 wrote to memory of 3120	1444	cmd.exe	151
PID 1444 wrote to memory of 3120	1444	cmd.exe	151
PID 1444 wrote to memory of 3120	1444	cmd.exe	151
PID 1952 wrote to memory of 2236	1952	INV-009484_PDF.exe	152
PID 1952 wrote to memory of 2236	1952	INV-009484_PDF.exe	152
PID 1952 wrote to memory of 2236	1952	INV-009484_PDF.exe	152
PID 2236 wrote to memory of 3968	2236	cmd.exe	154
PID 2236 wrote to memory of 3968	2236	cmd.exe	154
PID 2236 wrote to memory of 3968	2236	cmd.exe	154
PID 1952 wrote to memory of 732	1952	INV-009484_PDF.exe	155
PID 1952 wrote to memory of 732	1952	INV-009484_PDF.exe	155
PID 1952 wrote to memory of 732	1952	INV-009484_PDF.exe	155
PID 732 wrote to memory of 3304	732	cmd.exe	157
PID 732 wrote to memory of 3304	732	cmd.exe	157
PID 732 wrote to memory of 3304	732	cmd.exe	157
PID 1952 wrote to memory of 3792	1952	INV-009484_PDF.exe	158
PID 1952 wrote to memory of 3792	1952	INV-009484_PDF.exe	158
PID 1952 wrote to memory of 3792	1952	INV-009484_PDF.exe	158
PID 3792 wrote to memory of 572	3792	cmd.exe	160
PID 3792 wrote to memory of 572	3792	cmd.exe	160
PID 3792 wrote to memory of 572	3792	cmd.exe	160
PID 1952 wrote to memory of 3976	1952	INV-009484_PDF.exe	161
PID 1952 wrote to memory of 3976	1952	INV-009484_PDF.exe	161
PID 1952 wrote to memory of 3976	1952	INV-009484_PDF.exe	161
PID 3976 wrote to memory of 856	3976	cmd.exe	163
PID 3976 wrote to memory of 856	3976	cmd.exe	163
PID 3976 wrote to memory of 856	3976	cmd.exe	163
PID 1952 wrote to memory of 3896	1952	INV-009484_PDF.exe	164
PID 1952 wrote to memory of 3896	1952	INV-009484_PDF.exe	164
PID 1952 wrote to memory of 3896	1952	INV-009484_PDF.exe	164
PID 3896 wrote to memory of 576	3896	cmd.exe	166
PID 3896 wrote to memory of 576	3896	cmd.exe	166
PID 3896 wrote to memory of 576	3896	cmd.exe	166
PID 1952 wrote to memory of 3924	1952	INV-009484_PDF.exe	167
PID 1952 wrote to memory of 3924	1952	INV-009484_PDF.exe	167
PID 1952 wrote to memory of 3924	1952	INV-009484_PDF.exe	167
PID 3924 wrote to memory of 3900	3924	cmd.exe	169
PID 3924 wrote to memory of 3900	3924	cmd.exe	169
PID 3924 wrote to memory of 3900	3924	cmd.exe	169
PID 1952 wrote to memory of 3760	1952	INV-009484_PDF.exe	170
PID 1952 wrote to memory of 3760	1952	INV-009484_PDF.exe	170
PID 1952 wrote to memory of 3760	1952	INV-009484_PDF.exe	170
PID 3760 wrote to memory of 3244	3760	cmd.exe	172
PID 3760 wrote to memory of 3244	3760	cmd.exe	172
PID 3760 wrote to memory of 3244	3760	cmd.exe	172
PID 1952 wrote to memory of 3272	1952	INV-009484_PDF.exe	173
PID 1952 wrote to memory of 3272	1952	INV-009484_PDF.exe	173
PID 1952 wrote to memory of 3272	1952	INV-009484_PDF.exe	173
PID 3272 wrote to memory of 188	3272	cmd.exe	175
PID 3272 wrote to memory of 188	3272	cmd.exe	175
PID 3272 wrote to memory of 188	3272	cmd.exe	175
PID 1952 wrote to memory of 3424	1952	INV-009484_PDF.exe	176
PID 1952 wrote to memory of 3424	1952	INV-009484_PDF.exe	176
PID 1952 wrote to memory of 3424	1952	INV-009484_PDF.exe	176
PID 3424 wrote to memory of 2260	3424	cmd.exe	178
PID 3424 wrote to memory of 2260	3424	cmd.exe	178
PID 3424 wrote to memory of 2260	3424	cmd.exe	178
PID 1952 wrote to memory of 1728	1952	INV-009484_PDF.exe	179
PID 1952 wrote to memory of 1728	1952	INV-009484_PDF.exe	179
PID 1952 wrote to memory of 1728	1952	INV-009484_PDF.exe	179
PID 1728 wrote to memory of 1576	1728	cmd.exe	181
PID 1728 wrote to memory of 1576	1728	cmd.exe	181
PID 1728 wrote to memory of 1576	1728	cmd.exe	181
PID 1952 wrote to memory of 756	1952	INV-009484_PDF.exe	182
PID 1952 wrote to memory of 756	1952	INV-009484_PDF.exe	182
PID 1952 wrote to memory of 756	1952	INV-009484_PDF.exe	182

C:\Users\Admin\AppData\Local\Temp\INV-009484_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\INV-009484_PDF.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\INV-009484_PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\INV-009484_PDF.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Venom-ngrok" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\Venom-ngrok.exe" enable=yes & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Venom-ngrok" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\Venom-ngrok.exe" enable=yes
      4⤵
      PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\Venom-winvnc.exe" enable=yes & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\Venom-winvnc.exe" enable=yes
      4⤵
      PID:3264
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" enable=yes & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" enable=yes
      4⤵
      PID:4044
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\ngrok.exe" enable=yes & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\ngrok.exe" enable=yes
      4⤵
      PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\winvnc.exe" enable=yes & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:200
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\winvnc.exe" enable=yes
      4⤵
      PID:3420
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" enable=yes & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" enable=yes
      4⤵
      PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Windows Folder" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\autoupdate1.exe" enable=yes & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Windows Folder" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\autoupdate1.exe" enable=yes
      4⤵
      PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Windows Service" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\autoupdate2.exe" enable=yes & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Windows Service" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\autoupdate2.exe" enable=yes
      4⤵
      PID:1592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Windows Task" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\update.exe" enable=yes & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Windows Task" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\update.exe" enable=yes
      4⤵
      PID:3700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Windows" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\venom_nkrok.exe" enable=yes & exit
    3⤵
    PID:2988
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Windows" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Venom\venom_nkrok.exe" enable=yes
      4⤵
      PID:3916
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k netsh advfirewall firewall add rule name="Windows System" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\venom\nkrok.exe" enable=yes & exit
    3⤵
    PID:3992
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Windows System" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\venom\nkrok.exe" enable=yes
      4⤵
      PID:212
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "ngrok" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\Venom-ngrok.exe" -Action Allow & exit
    3⤵
    PID:492
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "ngrok" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\Venom-ngrok.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "ngrok" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\Venom-ngrok.exe" -Action Allow & exit
    3⤵
    PID:3188
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "ngrok" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\Venom-ngrok.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "vnc" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\Venom-winvnc.exe" -Action Allow & exit
    3⤵
    PID:3464
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "vnc" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\Venom-winvnc.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "vnc" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\Venom-winvnc.exe" -Action Allow & exit
    3⤵
    PID:184
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "vnc" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\Venom-winvnc.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2172
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "rdp" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" -Action Allow & exit
    3⤵
    PID:3960
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "rdp" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "rdp" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" -Action Allow & exit
    3⤵
    PID:2116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "rdp" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3668
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Google" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\ngrok.exe" -Action Allow & exit
    3⤵
    PID:2164
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Google" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\ngrok.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Google" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\ngrok.exe" -Action Allow & exit
    3⤵
    PID:2084
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Google" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\ngrok.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Chrome" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\winvnc.exe" -Action Allow & exit
    3⤵
    PID:3776
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Chrome" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\winvnc.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1220
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Chrome" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\winvnc.exe" -Action Allow & exit
    3⤵
    PID:3928
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Chrome" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\winvnc.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows Update" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" -Action Allow & exit
    3⤵
    PID:1496
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows Update" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows Update" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" -Action Allow & exit
    3⤵
    PID:3152
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows Update" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\rdpinstall.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows task" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\autoupdate1.exe" -Action Allow & exit
    3⤵
    PID:1444
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows task" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\autoupdate1.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3120
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows task" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\autoupdate1.exe" -Action Allow & exit
    3⤵
    PID:2236
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows task" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\autoupdate1.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows Service" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\autoupdate2.exe" -Action Allow & exit
    3⤵
    PID:732
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows Service" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\autoupdate2.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3304
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows Service" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\autoupdate2.exe" -Action Allow & exit
    3⤵
    PID:3792
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows Service" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\autoupdate2.exe" -Action Allow
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:572
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows Folder" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\update.exe" -Action Allow & exit
    3⤵
    PID:3976
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows Folder" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\update.exe" -Action Allow
      4⤵
      PID:856
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows Folder" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\update.exe" -Action Allow & exit
    3⤵
    PID:3896
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows Folder" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\update.exe" -Action Allow
      4⤵
      PID:576
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\venom_nkrok.exe" -Action Allow & exit
    3⤵
    PID:3924
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\Venom\venom_nkrok.exe" -Action Allow
      4⤵
      PID:3900
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\venom_nkrok.exe" -Action Allow & exit
    3⤵
    PID:3760
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\Venom\venom_nkrok.exe" -Action Allow
      4⤵
      PID:3244
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows System" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\venom\nkrok.exe" -Action Allow & exit
    3⤵
    PID:3272
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows System" -Direction Inbound -Program "C:\Users\Admin\AppData\Roaming\venom\nkrok.exe" -Action Allow
      4⤵
      PID:188
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k powershell New-NetFirewallRule -DisplayName "Windows System" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\venom\nkrok.exe" -Action Allow & exit
    3⤵
    PID:3424
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell New-NetFirewallRule -DisplayName "Windows System" -Direction Outbound -Program "C:\Users\Admin\AppData\Roaming\venom\nkrok.exe" -Action Allow
      4⤵
      PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming & exit
    3⤵
    PID:1728
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming
      4⤵
      PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\ & exit
    3⤵
    PID:756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 916
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/188-614-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/572-484-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/576-536-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/856-510-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/1176-146-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/1220-302-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/1292-680-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/1576-758-0x0000000008F90000-0x0000000008F91000-memory.dmp

Download

memory/1576-668-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/1576-760-0x0000000006810000-0x0000000006811000-memory.dmp

Download

memory/1580-354-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/1952-12-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Download

memory/1952-68-0x0000000006650000-0x0000000006651000-memory.dmp

Download

memory/1952-67-0x0000000006120000-0x0000000006121000-memory.dmp

Download

memory/1952-52-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/1952-69-0x0000000006690000-0x0000000006694000-memory.dmp

Download

memory/1952-664-0x00000000007B0000-0x00000000007B3000-memory.dmp

Download

memory/1952-8-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/1952-6-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/2060-276-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/2088-198-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/2172-178-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

Download

memory/2172-172-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/2260-640-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/2616-690-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/2668-13-0x00000000046E0000-0x00000000046E1000-memory.dmp

Download

memory/2668-17-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Download

memory/2700-250-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/2820-380-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/3120-406-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/3192-100-0x0000000007FC0000-0x0000000007FC1000-memory.dmp

Download

memory/3192-105-0x0000000009640000-0x0000000009673000-memory.dmp

Download

memory/3192-115-0x00000000098F0000-0x00000000098F1000-memory.dmp

Download

memory/3192-113-0x0000000009780000-0x0000000009781000-memory.dmp

Download

memory/3192-94-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/3192-95-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Download

memory/3192-96-0x0000000007590000-0x0000000007591000-memory.dmp

Download

memory/3192-97-0x0000000007C00000-0x0000000007C01000-memory.dmp

Download

memory/3192-98-0x0000000007CA0000-0x0000000007CA1000-memory.dmp

Download

memory/3192-101-0x0000000007D80000-0x0000000007D81000-memory.dmp

Download

memory/3192-102-0x0000000007F60000-0x0000000007F61000-memory.dmp

Download

memory/3192-103-0x00000000086C0000-0x00000000086C1000-memory.dmp

Download

memory/3192-114-0x0000000009940000-0x0000000009941000-memory.dmp

Download

memory/3192-112-0x0000000009620000-0x0000000009621000-memory.dmp

Download

memory/3244-588-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/3304-458-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/3472-120-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/3668-224-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/3692-328-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/3884-0-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/3884-4-0x0000000004D60000-0x0000000004E5B000-memory.dmp

Download

memory/3884-3-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Download

memory/3884-5-0x0000000005360000-0x0000000005361000-memory.dmp

Download

memory/3884-1-0x0000000000370000-0x0000000000371000-memory.dmp

Download

memory/3900-562-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/3968-432-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/4260-718-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/4504-747-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/4764-773-0x0000000074060000-0x000000007474E000-memory.dmp

Download

memory/5080-815-0x0000000074060000-0x000000007474E000-memory.dmp

Download