glupteba | 4e9bb871716df27af35ede8b153efa96e131321fa3ced426fce64b893ebd089a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	metina_3.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59440.exe	3gOxb8QqlwvqxjUC36sg5jdR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59440.exe	59440.exe

Loads dropped DLL 11 IoCs

pid	Process
2276	setup_install.exe
2276	setup_install.exe
2276	setup_install.exe
2276	setup_install.exe
2276	setup_install.exe
2276	setup_install.exe
2752	metina_4.tmp
4212	rUNdlL32.eXe
1096	metina_2.exe
4732	59440.exe
4716	dfrgui.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\Saelyjivufu.exe\""	_____Zi____DanE______10.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com
54	ip-api.com
146	ipinfo.io
148	ipinfo.io
259	ip-api.com
273	ipinfo.io
275	ipinfo.io
380	ipinfo.io

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	3gOxb8QqlwvqxjUC36sg5jdR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	59440.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	59440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	dfrgui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	dfrgui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	3gOxb8QqlwvqxjUC36sg5jdR.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dfrgui.exe	dfrgui.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4820 set thread context of 1676	4820	D3nORuPy6umpfs5VsDIQ3NwU.exe	134

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\runme.exe	b3ha5GsLPHccjxvM4N7ApIvt.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	b3ha5GsLPHccjxvM4N7ApIvt.exe
File created	C:\Program Files\Internet Explorer\VEXISRLSTJ\ultramediaburner.exe	_____Zi____DanE______10.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	b3ha5GsLPHccjxvM4N7ApIvt.exe
File created	C:\Program Files\Internet Explorer\VEXISRLSTJ\ultramediaburner.exe.config	_____Zi____DanE______10.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\Saelyjivufu.exe	_____Zi____DanE______10.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\Saelyjivufu.exe.config	_____Zi____DanE______10.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\file4.exe	b3ha5GsLPHccjxvM4N7ApIvt.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\lij.exe	b3ha5GsLPHccjxvM4N7ApIvt.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	b3ha5GsLPHccjxvM4N7ApIvt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 13 IoCs

pid	pid_target	Process	procid_target
4284	4652	WerFault.exe	103
4276	4652	WerFault.exe	103
5552	4652	WerFault.exe	103
5812	3860	WerFault.exe	119
5888	4652	WerFault.exe	103
6028	3860	WerFault.exe	119
4896	3860	WerFault.exe	119
4924	3860	WerFault.exe	119
5552	4652	WerFault.exe	103
3012	3860	WerFault.exe	119
3444	3860	WerFault.exe	119
6340	3860	WerFault.exe	119
6456	3860	WerFault.exe	119

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	metina_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	metina_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	metina_2.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4004	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3176	timeout.exe
4836	timeout.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
6744	taskkill.exe
5936	taskkill.exe
7388	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	metina_3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Process not Found

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4992	PING.EXE
2152	PING.EXE

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	274	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	277	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	373	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	389	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	147	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	151	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1096	metina_2.exe
1096	metina_2.exe
3868	jfiag3g_gg.exe
3868	jfiag3g_gg.exe
4732	59440.exe
4732	59440.exe
2996	Process not Found
2996	Process not Found
2996	Process not Found
2996	Process not Found
2996	Process not Found
2996	Process not Found
2996	Process not Found
2996	Process not Found
2996	Process not Found
2996	Process not Found
2996	Process not Found
2996	Process not Found
4232	ultramediaburner.tmp
4232	ultramediaburner.tmp
2996	Process not Found
2996	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1096	metina_2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	metina_6.exe
Token: SeDebugPrivilege	4336	_____Zi____DanE______10.exe
Token: SeDebugPrivilege	4820	D3nORuPy6umpfs5VsDIQ3NwU.exe
Token: SeDebugPrivilege	4892	Eof5r8STHxI6RC1OczJhafI2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2996	Process not Found
2996	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2276	3904	BBA60DFA5E58997112A5829898E2A7DD.exe	75
PID 3904 wrote to memory of 2276	3904	BBA60DFA5E58997112A5829898E2A7DD.exe	75
PID 3904 wrote to memory of 2276	3904	BBA60DFA5E58997112A5829898E2A7DD.exe	75
PID 2276 wrote to memory of 3680	2276	setup_install.exe	79
PID 2276 wrote to memory of 3680	2276	setup_install.exe	79
PID 2276 wrote to memory of 3680	2276	setup_install.exe	79
PID 2276 wrote to memory of 3984	2276	setup_install.exe	80
PID 2276 wrote to memory of 3984	2276	setup_install.exe	80
PID 2276 wrote to memory of 3984	2276	setup_install.exe	80
PID 2276 wrote to memory of 3044	2276	setup_install.exe	81
PID 2276 wrote to memory of 3044	2276	setup_install.exe	81
PID 2276 wrote to memory of 3044	2276	setup_install.exe	81
PID 2276 wrote to memory of 3332	2276	setup_install.exe	82
PID 2276 wrote to memory of 3332	2276	setup_install.exe	82
PID 2276 wrote to memory of 3332	2276	setup_install.exe	82
PID 2276 wrote to memory of 3400	2276	setup_install.exe	83
PID 2276 wrote to memory of 3400	2276	setup_install.exe	83
PID 2276 wrote to memory of 3400	2276	setup_install.exe	83
PID 3984 wrote to memory of 1096	3984	cmd.exe	95
PID 3984 wrote to memory of 1096	3984	cmd.exe	95
PID 3984 wrote to memory of 1096	3984	cmd.exe	95
PID 2276 wrote to memory of 1092	2276	setup_install.exe	84
PID 2276 wrote to memory of 1092	2276	setup_install.exe	84
PID 2276 wrote to memory of 1092	2276	setup_install.exe	84
PID 2276 wrote to memory of 416	2276	setup_install.exe	94
PID 2276 wrote to memory of 416	2276	setup_install.exe	94
PID 2276 wrote to memory of 416	2276	setup_install.exe	94
PID 2276 wrote to memory of 3360	2276	setup_install.exe	85
PID 2276 wrote to memory of 3360	2276	setup_install.exe	85
PID 2276 wrote to memory of 3360	2276	setup_install.exe	85
PID 2276 wrote to memory of 424	2276	setup_install.exe	86
PID 2276 wrote to memory of 424	2276	setup_install.exe	86
PID 2276 wrote to memory of 424	2276	setup_install.exe	86
PID 416 wrote to memory of 3928	416	cmd.exe	93
PID 416 wrote to memory of 3928	416	cmd.exe	93
PID 416 wrote to memory of 3928	416	cmd.exe	93
PID 2276 wrote to memory of 3884	2276	setup_install.exe	87
PID 2276 wrote to memory of 3884	2276	setup_install.exe	87
PID 2276 wrote to memory of 3884	2276	setup_install.exe	87
PID 3400 wrote to memory of 800	3400	cmd.exe	88
PID 3400 wrote to memory of 800	3400	cmd.exe	88
PID 3400 wrote to memory of 800	3400	cmd.exe	88
PID 3044 wrote to memory of 1576	3044	cmd.exe	89
PID 3044 wrote to memory of 1576	3044	cmd.exe	89
PID 3044 wrote to memory of 1576	3044	cmd.exe	89
PID 1092 wrote to memory of 1672	1092	cmd.exe	92
PID 1092 wrote to memory of 1672	1092	cmd.exe	92
PID 3680 wrote to memory of 2836	3680	cmd.exe	91
PID 3680 wrote to memory of 2836	3680	cmd.exe	91
PID 3680 wrote to memory of 2836	3680	cmd.exe	91
PID 3332 wrote to memory of 2720	3332	cmd.exe	90
PID 3332 wrote to memory of 2720	3332	cmd.exe	90
PID 3332 wrote to memory of 2720	3332	cmd.exe	90
PID 2720 wrote to memory of 2752	2720	metina_4.exe	96
PID 2720 wrote to memory of 2752	2720	metina_4.exe	96
PID 2720 wrote to memory of 2752	2720	metina_4.exe	96
PID 3928 wrote to memory of 4004	3928	metina_7.exe	97
PID 3928 wrote to memory of 4004	3928	metina_7.exe	97
PID 3928 wrote to memory of 4004	3928	metina_7.exe	97
PID 800 wrote to memory of 4148	800	metina_5.exe	99
PID 800 wrote to memory of 4148	800	metina_5.exe	99
PID 800 wrote to memory of 4148	800	metina_5.exe	99
PID 1576 wrote to memory of 4212	1576	metina_3.exe	100
PID 1576 wrote to memory of 4212	1576	metina_3.exe	100

C:\Users\Admin\AppData\Local\Temp\BBA60DFA5E58997112A5829898E2A7DD.exe
"C:\Users\Admin\AppData\Local\Temp\BBA60DFA5E58997112A5829898E2A7DD.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c metina_1.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\metina_1.exe
      metina_1.exe
      4⤵
      Executes dropped EXE
      PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c metina_2.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\metina_2.exe
      metina_2.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c metina_3.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\metina_3.exe
      metina_3.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
        5⤵
        Loads dropped DLL
        
        PID:4212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c metina_4.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\metina_4.exe
      metina_4.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\is-APV5H.tmp\metina_4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-APV5H.tmp\metina_4.tmp" /SL5="$80056,140518,56832,C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\metina_4.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\is-A84LH.tmp\_____Zi____DanE______10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-A84LH.tmp\_____Zi____DanE______10.exe" /S /UID=burnerch1
        6⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\56-6e634-8ee-2b68b-b8aa9b27f0a1d\SHanarezhifo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\56-6e634-8ee-2b68b-b8aa9b27f0a1d\SHanarezhifo.exe"
        7⤵
        Executes dropped EXE
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\bc-b39eb-3c0-518bd-a25f8d2c104ed\Xityfawobae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bc-b39eb-3c0-518bd-a25f8d2c104ed\Xityfawobae.exe"
        7⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0jwhlvvq.z4j\ebook.exe & exit
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\0jwhlvvq.z4j\ebook.exe
        
        C:\Users\Admin\AppData\Local\Temp\0jwhlvvq.z4j\ebook.exe
        9⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\0jwhlvvq.z4j\EBOOKE~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\0jwhlvvq.z4j\ebook.exe
        10⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\0jwhlvvq.z4j\EBOOKE~1.DLL,dRxZfDZgBQ==
        11⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp1108.tmp.ps1"
        12⤵
        
        PID:6904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jqbvrpov.dce\001.exe & exit
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\jqbvrpov.dce\001.exe
        
        C:\Users\Admin\AppData\Local\Temp\jqbvrpov.dce\001.exe
        9⤵
        
        PID:1836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hzjmqwey.zpl\md1_1eaf.exe & exit
        8⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\hzjmqwey.zpl\md1_1eaf.exe
        
        C:\Users\Admin\AppData\Local\Temp\hzjmqwey.zpl\md1_1eaf.exe
        9⤵
        
        PID:5748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x23tr3hu.vjz\installer.exe /qn CAMPAIGN="654" & exit
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\x23tr3hu.vjz\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\x23tr3hu.vjz\installer.exe /qn CAMPAIGN="654"
        9⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\x23tr3hu.vjz\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\x23tr3hu.vjz\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1621930417 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        10⤵
        
        PID:6772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vzmfz3ba.swj\gaoou.exe & exit
        8⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\vzmfz3ba.swj\gaoou.exe
        
        C:\Users\Admin\AppData\Local\Temp\vzmfz3ba.swj\gaoou.exe
        9⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:6464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4vvp0mva.o2w\Setup3310.exe /Verysilent /subid=623 & exit
        8⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\4vvp0mva.o2w\Setup3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\4vvp0mva.o2w\Setup3310.exe /Verysilent /subid=623
        9⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\is-EHJFC.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-EHJFC.tmp\Setup3310.tmp" /SL5="$103F0,138429,56832,C:\Users\Admin\AppData\Local\Temp\4vvp0mva.o2w\Setup3310.exe" /Verysilent /subid=623
        10⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\is-MQP9I.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-MQP9I.tmp\Setup.exe" /Verysilent
        11⤵
        
        PID:2208
        
        C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
        12⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
        13⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im RunWW.exe /f
        14⤵
        Kills process with taskkill
        
        PID:5936
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        14⤵
        Delays execution with timeout.exe
        
        PID:4836
        
        C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"
        12⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Roaming\1821053.exe
        
        "C:\Users\Admin\AppData\Roaming\1821053.exe"
        13⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Roaming\7509102.exe
        
        "C:\Users\Admin\AppData\Roaming\7509102.exe"
        13⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Roaming\6924824.exe
        
        "C:\Users\Admin\AppData\Roaming\6924824.exe"
        13⤵
        
        PID:1756
        
        C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
        12⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\is-61A67.tmp\lylal220.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-61A67.tmp\lylal220.tmp" /SL5="$5047E,140518,56832,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
        13⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\is-4D0U0.tmp\___________RUb__________y.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4D0U0.tmp\___________RUb__________y.exe" /S /UID=lylal220
        14⤵
        
        PID:6320
        
        C:\Program Files\Google\PTYLLPHCPN\irecord.exe
        
        "C:\Program Files\Google\PTYLLPHCPN\irecord.exe" /VERYSILENT
        15⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\is-RIVOA.tmp\irecord.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-RIVOA.tmp\irecord.tmp" /SL5="$404E6,6139911,56832,C:\Program Files\Google\PTYLLPHCPN\irecord.exe" /VERYSILENT
        16⤵
        
        PID:8092
        
        C:\Program Files (x86)\recording\i-record.exe
        
        "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
        17⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\e6-1f077-7f4-8ee88-d0ed3f07af81e\Gaxybibequ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e6-1f077-7f4-8ee88-d0ed3f07af81e\Gaxybibequ.exe"
        15⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\79-a201d-d84-62eb1-795e7b9d2e78c\Sozhejahete.exe
        
        "C:\Users\Admin\AppData\Local\Temp\79-a201d-d84-62eb1-795e7b9d2e78c\Sozhejahete.exe"
        15⤵
        
        PID:8136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r5b0wusn.yol\001.exe & exit
        16⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\r5b0wusn.yol\001.exe
        
        C:\Users\Admin\AppData\Local\Temp\r5b0wusn.yol\001.exe
        17⤵
        
        PID:6552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hi2wqdto.lrh\installer.exe /qn CAMPAIGN="654" & exit
        16⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\hi2wqdto.lrh\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\hi2wqdto.lrh\installer.exe /qn CAMPAIGN="654"
        17⤵
        
        PID:6152
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jvus1ztn.0it\gaoou.exe & exit
        16⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\jvus1ztn.0it\gaoou.exe
        
        C:\Users\Admin\AppData\Local\Temp\jvus1ztn.0it\gaoou.exe
        17⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        18⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        18⤵
        
        PID:8896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xntgze3o.i4u\Setup3310.exe /Verysilent /subid=623 & exit
        16⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\xntgze3o.i4u\Setup3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\xntgze3o.i4u\Setup3310.exe /Verysilent /subid=623
        17⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\is-9UVMB.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9UVMB.tmp\Setup3310.tmp" /SL5="$30452,138429,56832,C:\Users\Admin\AppData\Local\Temp\xntgze3o.i4u\Setup3310.exe" /Verysilent /subid=623
        18⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\is-KU415.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-KU415.tmp\Setup.exe" /Verysilent
        19⤵
        
        PID:8288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\smqf04rz.qev\google-game.exe & exit
        16⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\smqf04rz.qev\google-game.exe
        
        C:\Users\Admin\AppData\Local\Temp\smqf04rz.qev\google-game.exe
        17⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
        18⤵
        
        PID:8876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\02a1a03l.efa\toolspab1.exe & exit
        16⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\02a1a03l.efa\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\02a1a03l.efa\toolspab1.exe
        17⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\02a1a03l.efa\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\02a1a03l.efa\toolspab1.exe
        18⤵
        
        PID:4324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\buvhebxq.bk3\005.exe & exit
        16⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\buvhebxq.bk3\005.exe
        
        C:\Users\Admin\AppData\Local\Temp\buvhebxq.bk3\005.exe
        17⤵
        
        PID:5276
        
        C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
        12⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\is-6T66E.tmp\LabPicV3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-6T66E.tmp\LabPicV3.tmp" /SL5="$304B0,140559,56832,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
        13⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\is-Q5GBD.tmp\___________23.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-Q5GBD.tmp\___________23.exe" /S /UID=lab214
        14⤵
        
        PID:4180
        
        C:\Program Files\Windows Photo Viewer\BSHDAKVQAW\prolab.exe
        
        "C:\Program Files\Windows Photo Viewer\BSHDAKVQAW\prolab.exe" /VERYSILENT
        15⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\is-J2ARV.tmp\prolab.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-J2ARV.tmp\prolab.tmp" /SL5="$30318,575243,216576,C:\Program Files\Windows Photo Viewer\BSHDAKVQAW\prolab.exe" /VERYSILENT
        16⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\6b-e0d2a-cc3-5c69e-ad31916052a3f\Memaeshepavae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6b-e0d2a-cc3-5c69e-ad31916052a3f\Memaeshepavae.exe"
        15⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\56-91b48-e00-b88bc-cdeb4cd035f32\Hiraeluqiri.exe
        
        "C:\Users\Admin\AppData\Local\Temp\56-91b48-e00-b88bc-cdeb4cd035f32\Hiraeluqiri.exe"
        15⤵
        
        PID:6036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5e5ex2rz.kjq\001.exe & exit
        16⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\5e5ex2rz.kjq\001.exe
        
        C:\Users\Admin\AppData\Local\Temp\5e5ex2rz.kjq\001.exe
        17⤵
        
        PID:7560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\i4a3zos0.wj1\installer.exe /qn CAMPAIGN="654" & exit
        16⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\i4a3zos0.wj1\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\i4a3zos0.wj1\installer.exe /qn CAMPAIGN="654"
        17⤵
        
        PID:8180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4ogkuu2a.22a\gaoou.exe & exit
        16⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\4ogkuu2a.22a\gaoou.exe
        
        C:\Users\Admin\AppData\Local\Temp\4ogkuu2a.22a\gaoou.exe
        17⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        18⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        18⤵
        
        PID:7552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tpopgnxj.4ca\Setup3310.exe /Verysilent /subid=623 & exit
        16⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\tpopgnxj.4ca\Setup3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\tpopgnxj.4ca\Setup3310.exe /Verysilent /subid=623
        17⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\is-R5FFS.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-R5FFS.tmp\Setup3310.tmp" /SL5="$603BA,138429,56832,C:\Users\Admin\AppData\Local\Temp\tpopgnxj.4ca\Setup3310.exe" /Verysilent /subid=623
        18⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\is-M2FML.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-M2FML.tmp\Setup.exe" /Verysilent
        19⤵
        
        PID:7396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\su5odciq.u4o\google-game.exe & exit
        16⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\su5odciq.u4o\google-game.exe
        
        C:\Users\Admin\AppData\Local\Temp\su5odciq.u4o\google-game.exe
        17⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
        18⤵
        
        PID:4376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ojsnxhvg.0ql\toolspab1.exe & exit
        16⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\ojsnxhvg.0ql\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\ojsnxhvg.0ql\toolspab1.exe
        17⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\ojsnxhvg.0ql\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\ojsnxhvg.0ql\toolspab1.exe
        18⤵
        
        PID:6488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2jv545e2.vog\005.exe & exit
        16⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\2jv545e2.vog\005.exe
        
        C:\Users\Admin\AppData\Local\Temp\2jv545e2.vog\005.exe
        17⤵
        
        PID:4500
        
        C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
        12⤵
        
        PID:4540
        
        C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
        12⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        13⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        13⤵
        
        PID:4084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cj5aqf35.xz3\google-game.exe & exit
        8⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\cj5aqf35.xz3\google-game.exe
        
        C:\Users\Admin\AppData\Local\Temp\cj5aqf35.xz3\google-game.exe
        9⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
        10⤵
        
        PID:6204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\m2vhm0z5.erq\toolspab1.exe & exit
        8⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\m2vhm0z5.erq\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\m2vhm0z5.erq\toolspab1.exe
        9⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\m2vhm0z5.erq\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\m2vhm0z5.erq\toolspab1.exe
        10⤵
        
        PID:6568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1e41aozy.wcx\005.exe & exit
        8⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\1e41aozy.wcx\005.exe
        
        C:\Users\Admin\AppData\Local\Temp\1e41aozy.wcx\005.exe
        9⤵
        
        PID:4376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ea53w2wd.hpa\installer.exe /qn CAMPAIGN="654" & exit
        8⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\ea53w2wd.hpa\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\ea53w2wd.hpa\installer.exe /qn CAMPAIGN="654"
        9⤵
        
        PID:8236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rm1kqbwl.aq4\702564a0.exe & exit
        8⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\rm1kqbwl.aq4\702564a0.exe
        
        C:\Users\Admin\AppData\Local\Temp\rm1kqbwl.aq4\702564a0.exe
        9⤵
        
        PID:6116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ak4ktrdd.nj4\app.exe /8-2222 & exit
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\ak4ktrdd.nj4\app.exe
        
        C:\Users\Admin\AppData\Local\Temp\ak4ktrdd.nj4\app.exe /8-2222
        9⤵
        
        PID:7072
        
        C:\Program Files\Internet Explorer\VEXISRLSTJ\ultramediaburner.exe
        
        "C:\Program Files\Internet Explorer\VEXISRLSTJ\ultramediaburner.exe" /VERYSILENT
        7⤵
        Executes dropped EXE
        
        PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c metina_5.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\metina_5.exe
      metina_5.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c metina_6.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\metina_6.exe
      metina_6.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1672
    - - C:\Users\Admin\AppData\Roaming\RR9yJlcFJFlGI65l2z0ZIo87.exe
        
        "C:\Users\Admin\AppData\Roaming\RR9yJlcFJFlGI65l2z0ZIo87.exe"
        5⤵
        Executes dropped EXE
        
        PID:4660
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\RR9yJlcFJFlGI65l2z0ZIo87.exe"
        6⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        7⤵
        Runs ping.exe
        
        PID:4992
    - - C:\Users\Admin\AppData\Roaming\qTzo1jxlYC9Zmqo3VgXjtFQy.exe
        
        "C:\Users\Admin\AppData\Roaming\qTzo1jxlYC9Zmqo3VgXjtFQy.exe"
        5⤵
        Executes dropped EXE
        
        PID:4652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 656
        6⤵
        Program crash
        
        PID:4284
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 672
        6⤵
        Program crash
        
        PID:4276
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 768
        6⤵
        Program crash
        
        PID:5552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 804
        6⤵
        Program crash
        
        PID:5888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 1072
        6⤵
        Program crash
        
        PID:5552
    - - C:\Users\Admin\AppData\Roaming\b3ha5GsLPHccjxvM4N7ApIvt.exe
        
        "C:\Users\Admin\AppData\Roaming\b3ha5GsLPHccjxvM4N7ApIvt.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4688
      - C:\Program Files (x86)\Company\NewProduct\runme.exe
        
        "C:\Program Files (x86)\Company\NewProduct\runme.exe"
        6⤵
        Executes dropped EXE
        
        PID:3860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 656
        7⤵
        Program crash
        
        PID:5812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 672
        7⤵
        Program crash
        
        PID:6028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 768
        7⤵
        Program crash
        
        PID:4896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 804
        7⤵
        Program crash
        
        PID:4924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 1272
        7⤵
        Program crash
        
        PID:3012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 1312
        7⤵
        Program crash
        
        PID:3444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 1396
        7⤵
        Program crash
        
        PID:6340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 1380
        7⤵
        Program crash
        
        PID:6456
      - C:\Program Files (x86)\Company\NewProduct\file4.exe
        
        "C:\Program Files (x86)\Company\NewProduct\file4.exe"
        6⤵
        Executes dropped EXE
        
        PID:3180
      - C:\Program Files (x86)\Company\NewProduct\lij.exe
        
        "C:\Program Files (x86)\Company\NewProduct\lij.exe"
        6⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
        7⤵
        
        PID:5560
      - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        6⤵
        Executes dropped EXE
        
        PID:4932
    - - C:\Users\Admin\AppData\Roaming\l8V7wCppKfuowbvEOqxNogyP.exe
        
        "C:\Users\Admin\AppData\Roaming\l8V7wCppKfuowbvEOqxNogyP.exe"
        5⤵
        Executes dropped EXE
        
        PID:4676
      - C:\Users\Admin\AppData\Roaming\l8V7wCppKfuowbvEOqxNogyP.exe
        
        "C:\Users\Admin\AppData\Roaming\l8V7wCppKfuowbvEOqxNogyP.exe"
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Roaming\Vq4ttim4yWSHFQO4pOlrgKax.exe
        
        "C:\Users\Admin\AppData\Roaming\Vq4ttim4yWSHFQO4pOlrgKax.exe"
        5⤵
        Executes dropped EXE
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Roaming\S9zqTBomTBWPEBJDWa0BddCF.exe
        
        "C:\Users\Admin\AppData\Roaming\S9zqTBomTBWPEBJDWa0BddCF.exe"
        5⤵
        Executes dropped EXE
        
        PID:4856
      - C:\Users\Admin\AppData\Roaming\S9zqTBomTBWPEBJDWa0BddCF.exe
        
        "C:\Users\Admin\AppData\Roaming\S9zqTBomTBWPEBJDWa0BddCF.exe"
        6⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Roaming\Eof5r8STHxI6RC1OczJhafI2.exe
        
        "C:\Users\Admin\AppData\Roaming\Eof5r8STHxI6RC1OczJhafI2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
      - C:\Users\Admin\AppData\Roaming\8359972.exe
        
        "C:\Users\Admin\AppData\Roaming\8359972.exe"
        6⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Roaming\2829606.exe
        
        "C:\Users\Admin\AppData\Roaming\2829606.exe"
        6⤵
        
        PID:4648
        
        C:\ProgramData\Windows Host\Windows Host.exe
        
        "C:\ProgramData\Windows Host\Windows Host.exe"
        7⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Roaming\ilinUeoifn2xUEBWhT9hZMtu.exe
        
        "C:\Users\Admin\AppData\Roaming\ilinUeoifn2xUEBWhT9hZMtu.exe"
        5⤵
        Executes dropped EXE
        
        PID:4192
      - C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Roaming\KveuObglDBHwEr7l0tD6WK2D.exe
        
        "C:\Users\Admin\AppData\Roaming\KveuObglDBHwEr7l0tD6WK2D.exe"
        5⤵
        Executes dropped EXE
        
        PID:5012
    - - C:\Users\Admin\AppData\Roaming\gEfFowMQWpTeBRFe03ZrJ6Tl.exe
        
        "C:\Users\Admin\AppData\Roaming\gEfFowMQWpTeBRFe03ZrJ6Tl.exe"
        5⤵
        Executes dropped EXE
        
        PID:4952
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\gEfFowMQWpTeBRFe03ZrJ6Tl.exe"
        6⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        7⤵
        Delays execution with timeout.exe
        
        PID:3176
    - - C:\Users\Admin\AppData\Roaming\D3nORuPy6umpfs5VsDIQ3NwU.exe
        
        "C:\Users\Admin\AppData\Roaming\D3nORuPy6umpfs5VsDIQ3NwU.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
        6⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Roaming\3gOxb8QqlwvqxjUC36sg5jdR.exe
        
        "C:\Users\Admin\AppData\Roaming\3gOxb8QqlwvqxjUC36sg5jdR.exe"
        5⤵
        Executes dropped EXE
        Drops startup file
        Maps connected drives based on registry
        
        PID:4756
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\del.bat
        6⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 3
        7⤵
        Runs ping.exe
        
        PID:2152
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c del "C:\Users\Admin\AppData\Roaming\del.bat"
        7⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59440.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59440.exe"
        6⤵
        Executes dropped EXE
        Drops startup file
        Loads dropped DLL
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4732
    - - C:\Users\Admin\AppData\Roaming\zhbVB04wxJVlJXl2YTxY27vz.exe
        
        "C:\Users\Admin\AppData\Roaming\zhbVB04wxJVlJXl2YTxY27vz.exe"
        5⤵
        
        PID:6864
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Roaming\ZHBVB0~1.DLL,Z C:\Users\Admin\AppData\Roaming\ZHBVB0~1.EXE
        6⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Roaming\ZHBVB0~1.DLL,GxMIfDaLBbw=
        7⤵
        
        PID:5592
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "metina_6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\metina_6.exe" & exit
        5⤵
        
        PID:5936
      - C:\Windows\system32\taskkill.exe
        
        taskkill /im "metina_6.exe" /f
        6⤵
        Kills process with taskkill
        
        PID:6744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c metina_8.exe
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c metina_9.exe
    3⤵
    PID:424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c metina_10.exe
    3⤵
    PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c metina_7.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:416

C:\Users\Admin\AppData\Local\Temp\7zS04FDA234\metina_7.exe
metina_7.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
  2⤵
  PID:4004
- - C:\Windows\SysWOW64\rUNdlL32.eXe
    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",getname
    3⤵
    PID:4988
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\PbOSetp.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PbOSetp.exe"
  2⤵
  PID:5140
- - C:\Users\Admin\AppData\Roaming\7829592.exe
    "C:\Users\Admin\AppData\Roaming\7829592.exe"
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Roaming\6747983.exe
    "C:\Users\Admin\AppData\Roaming\6747983.exe"
    3⤵
    PID:6136

C:\Windows\SysWOW64\dfrgui.exe
"C:\Windows\system32\dfrgui.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
PID:4716
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 5 /tn "Update" /tr "%SYSTEMDRIVE%\Users\%USERNAME%\AppData\Local\zz%USERNAME%\%USERNAME%.vbs" /F
  2⤵
  - Executes dropped EXE
  - Creates scheduled task(s)
  PID:4004

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
1⤵
PID:4960

C:\Users\Admin\AppData\Local\Temp\is-SHDLN.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-SHDLN.tmp\ultramediaburner.tmp" /SL5="$30244,281924,62464,C:\Program Files\Internet Explorer\VEXISRLSTJ\ultramediaburner.exe" /VERYSILENT
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:6080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:4936

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6704
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F291F60BF80D621B03E924EB4B32D217 C
  2⤵
  PID:7000
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0550A7859F397E461A635051CBD4E55B
  2⤵
  PID:6944
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:7388
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E81B2CAEA160CF6EA881966033597F0 E Global\MSI0000
  2⤵
  PID:7676

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6804

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7160

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7268

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:1880

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:7620

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6792

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7752

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6880

C:\Users\Admin\AppData\Local\Temp\8677.exe
C:\Users\Admin\AppData\Local\Temp\8677.exe
1⤵
PID:7472

C:\Users\Admin\AppData\Local\Temp\94C0.exe
C:\Users\Admin\AppData\Local\Temp\94C0.exe
1⤵
PID:5136

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8412

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8756

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:7332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery