Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

URLScan

urlscan

https://crackhomes.c...

windows10_x64

Analysis

  • max time kernel
    419s
  • max time network
    421s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    23/06/2021, 14:52

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Remote task has failed: Machine shutdown
Report Analysis Logs

General

  • Target

    https://crackhomes.com

  • Sample

    210623-ew2t727sa2

Score
10/10
plugxredlinesmokeloadervidaraspackv2backdoorbootkitdiscoveryevasioninfostealerpersistencespywarestealerthemidatrojanupx

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Modifies visibility of file extensions in Explorer 2 TTPs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs
    evasion
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 8 IoCs
    stealer
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 50 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 6 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:284
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2660
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://crackhomes.com
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3972
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://crackhomes.com
          2⤵
          • Checks processor information in registry
          • NTFS ADS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:800
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.0.175407532\1030148282" -parentBuildID 20200403170909 -prefsHandle 1528 -prefMapHandle 1304 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 1604 gpu
            3⤵
              PID:2764
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.3.1813559663\1903893037" -childID 1 -isForBrowser -prefsHandle 2328 -prefMapHandle 2220 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 2340 tab
              3⤵
                PID:2116
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.13.302478400\1962720098" -childID 2 -isForBrowser -prefsHandle 3332 -prefMapHandle 3328 -prefsLen 7013 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 3316 tab
                3⤵
                  PID:4020
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.20.1229796221\714970934" -childID 3 -isForBrowser -prefsHandle 4312 -prefMapHandle 4232 -prefsLen 7784 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 4172 tab
                  3⤵
                    PID:4428
                  • C:\Program Files\Mozilla Firefox\uninstall\helper.exe
                    "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppUser
                    3⤵
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4580
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.27.739347950\1152185440" -childID 4 -isForBrowser -prefsHandle 4176 -prefMapHandle 4200 -prefsLen 8108 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 4064 tab
                    3⤵
                      PID:1192
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.34.1065409268\1204351869" -childID 5 -isForBrowser -prefsHandle 3988 -prefMapHandle 3928 -prefsLen 8108 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 4556 tab
                      3⤵
                        PID:4408
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.41.129662757\1320775481" -childID 6 -isForBrowser -prefsHandle 5204 -prefMapHandle 5200 -prefsLen 8895 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 5188 tab
                        3⤵
                          PID:4784
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.48.75321760\521485536" -childID 7 -isForBrowser -prefsHandle 3560 -prefMapHandle 1464 -prefsLen 8895 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 3880 tab
                          3⤵
                            PID:4208
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                        1⤵
                          PID:2636
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s Browser
                          1⤵
                            PID:2556
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2376
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                            1⤵
                              PID:2336
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                              1⤵
                                PID:1944
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                1⤵
                                  PID:1408
                                • c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                  1⤵
                                    PID:1256
                                  • c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                    1⤵
                                      PID:1216
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                      1⤵
                                        PID:1100
                                      • c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                        1⤵
                                        • Drops file in System32 directory
                                        PID:936
                                      • \??\c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                        1⤵
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1896
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                          2⤵
                                          • Drops file in System32 directory
                                          • Checks processor information in registry
                                          • Modifies data under HKEY_USERS
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4664
                                      • C:\Windows\ImmersiveControlPanel\SystemSettings.exe
                                        "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
                                        1⤵
                                        • Checks SCSI registry key(s)
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4700
                                      • C:\Windows\System32\rundll32.exe
                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                        1⤵
                                          PID:4368
                                        • C:\Program Files\7-Zip\7zG.exe
                                          "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\" -spe -an -ai#7zMap4474:102:7zEvent23488
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          PID:988
                                        • C:\Windows\system32\NOTEPAD.EXE
                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d-Passw0rd.txt
                                          1⤵
                                            PID:376
                                          • C:\Program Files\7-Zip\7zG.exe
                                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d_setupInstall\" -spe -an -ai#7zMap9402:296:7zEvent20697
                                            1⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            PID:5032
                                          • C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d_setupInstall\setup_x86_x64_install.exe
                                            "C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d_setupInstall\setup_x86_x64_install.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5024
                                            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2672
                                              • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\setup_install.exe
                                                "C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\setup_install.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2132
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c arnatic_3.exe
                                                  4⤵
                                                    PID:4744
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_3.exe
                                                      arnatic_3.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Checks computer location settings
                                                      PID:1420
                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                        6⤵
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3560
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c arnatic_5.exe
                                                    4⤵
                                                      PID:4704
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_5.exe
                                                        arnatic_5.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1524
                                                        • C:\Users\Admin\AppData\Roaming\6375432.exe
                                                          "C:\Users\Admin\AppData\Roaming\6375432.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          PID:4400
                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            PID:5320
                                                        • C:\Users\Admin\AppData\Roaming\1777945.exe
                                                          "C:\Users\Admin\AppData\Roaming\1777945.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4944
                                                        • C:\Users\Admin\AppData\Roaming\2972918.exe
                                                          "C:\Users\Admin\AppData\Roaming\2972918.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4984
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c arnatic_7.exe
                                                      4⤵
                                                        PID:340
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                          arnatic_7.exe
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:680
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                            C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                            6⤵
                                                            • Executes dropped EXE
                                                            PID:3692
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                            C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4740
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c arnatic_8.exe
                                                        4⤵
                                                          PID:988
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_8.exe
                                                            arnatic_8.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4196
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c arnatic_6.exe
                                                          4⤵
                                                            PID:4460
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c arnatic_4.exe
                                                            4⤵
                                                              PID:4864
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c arnatic_2.exe
                                                              4⤵
                                                                PID:4748
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c arnatic_1.exe
                                                                4⤵
                                                                  PID:4492
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_6.exe
                                                            arnatic_6.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4992
                                                            • C:\Users\Admin\Documents\ZxFIOn_Ng13y8LFUwYbc1chf.exe
                                                              "C:\Users\Admin\Documents\ZxFIOn_Ng13y8LFUwYbc1chf.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Checks processor information in registry
                                                              PID:5684
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im ZxFIOn_Ng13y8LFUwYbc1chf.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\ZxFIOn_Ng13y8LFUwYbc1chf.exe" & del C:\ProgramData\*.dll & exit
                                                                3⤵
                                                                  PID:4528
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /im ZxFIOn_Ng13y8LFUwYbc1chf.exe /f
                                                                    4⤵
                                                                    • Kills process with taskkill
                                                                    PID:2740
                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                    timeout /t 6
                                                                    4⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:5764
                                                              • C:\Users\Admin\Documents\v7XdAA9YBtZonOfPUqAJmwdf.exe
                                                                "C:\Users\Admin\Documents\v7XdAA9YBtZonOfPUqAJmwdf.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Checks BIOS information in registry
                                                                • Checks whether UAC is enabled
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5732
                                                              • C:\Users\Admin\Documents\ZlmjxMexvqKUuB0JhPeiMaev.exe
                                                                "C:\Users\Admin\Documents\ZlmjxMexvqKUuB0JhPeiMaev.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Checks processor information in registry
                                                                PID:5748
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im ZlmjxMexvqKUuB0JhPeiMaev.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\ZlmjxMexvqKUuB0JhPeiMaev.exe" & del C:\ProgramData\*.dll & exit
                                                                  3⤵
                                                                    PID:1828
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /im ZlmjxMexvqKUuB0JhPeiMaev.exe /f
                                                                      4⤵
                                                                      • Kills process with taskkill
                                                                      PID:4036
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout /t 6
                                                                      4⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:4896
                                                                • C:\Users\Admin\Documents\XoFkZ2Tjbwbsdzl7lHtebPfV.exe
                                                                  "C:\Users\Admin\Documents\XoFkZ2Tjbwbsdzl7lHtebPfV.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:5824
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 660
                                                                    3⤵
                                                                    • Drops file in Windows directory
                                                                    • Program crash
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5536
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 676
                                                                    3⤵
                                                                    • Program crash
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4568
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 664
                                                                    3⤵
                                                                    • Program crash
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5528
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 700
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:4836
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1040
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:5764
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1256
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:2076
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1324
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:6092
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1416
                                                                    3⤵
                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                    • Program crash
                                                                    PID:5476
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1476
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:1492
                                                                • C:\Users\Admin\Documents\ZdWz1oISd9pI4ETvRtKmdPgn.exe
                                                                  "C:\Users\Admin\Documents\ZdWz1oISd9pI4ETvRtKmdPgn.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  PID:5836
                                                                  • C:\Program Files (x86)\Browzar\NVdpapR9v21C.exe
                                                                    "C:\Program Files (x86)\Browzar\NVdpapR9v21C.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:4748
                                                                    • C:\Program Files (x86)\Browzar\NVdpapR9v21C.exe
                                                                      "C:\Program Files (x86)\Browzar\NVdpapR9v21C.exe"
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:2228
                                                                  • C:\Program Files (x86)\Browzar\Browzar.exe
                                                                    "C:\Program Files (x86)\Browzar\Browzar.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    PID:5892
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 2596
                                                                      4⤵
                                                                      • Program crash
                                                                      PID:5368
                                                                • C:\Users\Admin\Documents\MeyUhQsz8c_YBoG4b4B7yASO.exe
                                                                  "C:\Users\Admin\Documents\MeyUhQsz8c_YBoG4b4B7yASO.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  PID:5872
                                                                  • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                    "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:5484
                                                                  • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:3860
                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                      4⤵
                                                                        PID:6052
                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                        4⤵
                                                                          PID:2228
                                                                      • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                        "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Checks computer location settings
                                                                        PID:5436
                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                          4⤵
                                                                          • Loads dropped DLL
                                                                          PID:2668
                                                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Checks whether UAC is enabled
                                                                        • Drops file in Program Files directory
                                                                        PID:5576
                                                                    • C:\Users\Admin\Documents\Rl6_LZwlHWu_4sGEBW9lU3TN.exe
                                                                      "C:\Users\Admin\Documents\Rl6_LZwlHWu_4sGEBW9lU3TN.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5928
                                                                      • C:\Users\Admin\Documents\Rl6_LZwlHWu_4sGEBW9lU3TN.exe
                                                                        C:\Users\Admin\Documents\Rl6_LZwlHWu_4sGEBW9lU3TN.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:5692
                                                                    • C:\Users\Admin\Documents\3xK7933E6oFUpw9WpCLlzHkg.exe
                                                                      "C:\Users\Admin\Documents\3xK7933E6oFUpw9WpCLlzHkg.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:5980
                                                                    • C:\Users\Admin\Documents\_CDDfk1YnZNqH8zkqupf13JG.exe
                                                                      "C:\Users\Admin\Documents\_CDDfk1YnZNqH8zkqupf13JG.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:6044
                                                                      • C:\Users\Admin\Documents\_CDDfk1YnZNqH8zkqupf13JG.exe
                                                                        C:\Users\Admin\Documents\_CDDfk1YnZNqH8zkqupf13JG.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks processor information in registry
                                                                        PID:5716
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im _CDDfk1YnZNqH8zkqupf13JG.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\_CDDfk1YnZNqH8zkqupf13JG.exe" & del C:\ProgramData\*.dll & exit
                                                                          4⤵
                                                                            PID:3516
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /im _CDDfk1YnZNqH8zkqupf13JG.exe /f
                                                                              5⤵
                                                                              • Kills process with taskkill
                                                                              PID:5036
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout /t 6
                                                                              5⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:4924
                                                                      • C:\Users\Admin\Documents\d8UE1Z51rF02pkMR0HASp44l.exe
                                                                        "C:\Users\Admin\Documents\d8UE1Z51rF02pkMR0HASp44l.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5888
                                                                        • C:\Users\Admin\Documents\d8UE1Z51rF02pkMR0HASp44l.exe
                                                                          C:\Users\Admin\Documents\d8UE1Z51rF02pkMR0HASp44l.exe
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:5668
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 24
                                                                            4⤵
                                                                            • Program crash
                                                                            PID:200
                                                                      • C:\Users\Admin\Documents\D9OHjqIwIVRyI5vFizY0DKLI.exe
                                                                        "C:\Users\Admin\Documents\D9OHjqIwIVRyI5vFizY0DKLI.exe"
                                                                        2⤵
                                                                        • Drops file in Drivers directory
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        PID:5200
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                          3⤵
                                                                          • Enumerates system info in registry
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          PID:1076
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xe4,0xe8,0xec,0x7c,0xf0,0x7ffbc1f04f50,0x7ffbc1f04f60,0x7ffbc1f04f70
                                                                            4⤵
                                                                              PID:4020
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
                                                                              4⤵
                                                                                PID:5636
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1876 /prefetch:8
                                                                                4⤵
                                                                                  PID:5076
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1824 /prefetch:2
                                                                                  4⤵
                                                                                    PID:3096
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2600 /prefetch:1
                                                                                    4⤵
                                                                                      PID:5520
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:1
                                                                                      4⤵
                                                                                        PID:5664
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
                                                                                        4⤵
                                                                                          PID:5616
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
                                                                                          4⤵
                                                                                            PID:3188
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
                                                                                            4⤵
                                                                                              PID:1964
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
                                                                                              4⤵
                                                                                                PID:5760
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
                                                                                                4⤵
                                                                                                  PID:2084
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "cmd.exe" /C taskkill /F /PID 5200 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\D9OHjqIwIVRyI5vFizY0DKLI.exe"
                                                                                                3⤵
                                                                                                  PID:1000
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    taskkill /F /PID 5200
                                                                                                    4⤵
                                                                                                    • Kills process with taskkill
                                                                                                    PID:5620
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "cmd.exe" /C taskkill /F /PID 5200 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\D9OHjqIwIVRyI5vFizY0DKLI.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:6052
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    taskkill /F /PID 5200
                                                                                                    4⤵
                                                                                                    • Kills process with taskkill
                                                                                                    PID:5012
                                                                                              • C:\Users\Admin\Documents\pz3OGPMJLz27c5CyifMuMYx6.exe
                                                                                                "C:\Users\Admin\Documents\pz3OGPMJLz27c5CyifMuMYx6.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3884
                                                                                                • C:\Users\Admin\Documents\pz3OGPMJLz27c5CyifMuMYx6.exe
                                                                                                  "C:\Users\Admin\Documents\pz3OGPMJLz27c5CyifMuMYx6.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:4672
                                                                                              • C:\Users\Admin\Documents\Q8NAXtrxoylrXjJCNK1iHcMA.exe
                                                                                                "C:\Users\Admin\Documents\Q8NAXtrxoylrXjJCNK1iHcMA.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks computer location settings
                                                                                                • Modifies registry class
                                                                                                PID:5280
                                                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                  3⤵
                                                                                                  • Loads dropped DLL
                                                                                                  PID:3064
                                                                                              • C:\Users\Admin\Documents\rGdPj3fL041nagUY7dg1izMD.exe
                                                                                                "C:\Users\Admin\Documents\rGdPj3fL041nagUY7dg1izMD.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5128
                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:6104
                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                  3⤵
                                                                                                    PID:2228
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_2.exe
                                                                                                arnatic_2.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                PID:3820
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_4.exe
                                                                                                arnatic_4.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:376
                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4384
                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:6112
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_1.exe
                                                                                                arnatic_1.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks processor information in registry
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:4828
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_1.exe" & del C:\ProgramData\*.dll & exit
                                                                                                  2⤵
                                                                                                    PID:3504
                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                      taskkill /im arnatic_1.exe /f
                                                                                                      3⤵
                                                                                                      • Kills process with taskkill
                                                                                                      PID:2628
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout /t 6
                                                                                                      3⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:3868
                                                                                                • C:\Windows\system32\werfault.exe
                                                                                                  werfault.exe /h /shared Global\c80c8351ee474942813ab16260fb6143 /t 1860 /p 3008
                                                                                                  1⤵
                                                                                                    PID:6068
                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                                    1⤵
                                                                                                    • Checks SCSI registry key(s)
                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    PID:6120
                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                    1⤵
                                                                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                    PID:5100
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                    1⤵
                                                                                                      PID:5844
                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                        2⤵
                                                                                                        • Checks processor information in registry
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                        PID:4112
                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.0.862220334\865236648" -parentBuildID 20200403170909 -prefsHandle 1472 -prefMapHandle 1464 -prefsLen 1 -prefMapSize 220413 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 1524 gpu
                                                                                                          3⤵
                                                                                                            PID:5032
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.3.1725119642\740040684" -childID 1 -isForBrowser -prefsHandle 5152 -prefMapHandle 5148 -prefsLen 397 -prefMapSize 220413 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 5164 tab
                                                                                                            3⤵
                                                                                                              PID:6108
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.13.783671645\1702720206" -childID 2 -isForBrowser -prefsHandle 2668 -prefMapHandle 2704 -prefsLen 6628 -prefMapSize 220413 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2736 tab
                                                                                                              3⤵
                                                                                                                PID:5188
                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.20.240203191\811431848" -childID 3 -isForBrowser -prefsHandle 2620 -prefMapHandle 2844 -prefsLen 6628 -prefMapSize 220413 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2748 tab
                                                                                                                3⤵
                                                                                                                  PID:5004
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.27.1513101391\1117425437" -childID 4 -isForBrowser -prefsHandle 2348 -prefMapHandle 2444 -prefsLen 7411 -prefMapSize 220413 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2748 tab
                                                                                                                  3⤵
                                                                                                                    PID:4744
                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.34.228737146\545575952" -childID 5 -isForBrowser -prefsHandle 7212 -prefMapHandle 7376 -prefsLen 7526 -prefMapSize 220413 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2000 tab
                                                                                                                    3⤵
                                                                                                                      PID:5780
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2940.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2940.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:5648
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\48AB.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\48AB.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Writes to the Master Boot Record (MBR)
                                                                                                                  PID:4964

                                                                                                                Network

                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                • memory/284-246-0x000001E9D2720000-0x000001E9D2791000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/680-210-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/680-206-0x0000000000810000-0x0000000000811000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/936-307-0x000001FCFCFD0000-0x000001FCFD041000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/1100-286-0x0000022791B30000-0x0000022791BA1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/1216-301-0x00000219A3B00000-0x00000219A3B71000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/1256-299-0x000001CB5A8D0000-0x000001CB5A941000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/1408-292-0x000002490C840000-0x000002490C8B1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/1524-208-0x00000000009E0000-0x00000000009E1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/1524-203-0x0000000000890000-0x0000000000891000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/1524-212-0x000000001B670000-0x000000001B672000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                  Download

                                                                                                                • memory/1524-209-0x0000000000D00000-0x0000000000D20000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/1524-211-0x00000000009F0000-0x00000000009F1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/1896-260-0x00000254322F0000-0x0000025432361000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/1944-296-0x0000021E26FD0000-0x0000021E27041000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/2132-178-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  100KB

                                                                                                                  Download

                                                                                                                • memory/2132-169-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  100KB

                                                                                                                  Download

                                                                                                                • memory/2132-168-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  100KB

                                                                                                                  Download

                                                                                                                • memory/2132-167-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.1MB

                                                                                                                  Download

                                                                                                                • memory/2132-166-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  152KB

                                                                                                                  Download

                                                                                                                • memory/2132-165-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.5MB

                                                                                                                  Download

                                                                                                                • memory/2132-164-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  572KB

                                                                                                                  Download

                                                                                                                • memory/2132-180-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  100KB

                                                                                                                  Download

                                                                                                                • memory/2336-254-0x0000022D32210000-0x0000022D32281000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/2376-263-0x0000028914880000-0x00000289148F1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/2556-236-0x000001833F0D0000-0x000001833F141000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/2556-226-0x000001833E830000-0x000001833E87C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  304KB

                                                                                                                  Download

                                                                                                                • memory/2636-305-0x000002BC90080000-0x000002BC900F1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/2660-306-0x000001D1896C0000-0x000001D189731000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/3008-347-0x00000000066A0000-0x00000000066B6000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  88KB

                                                                                                                  Download

                                                                                                                • memory/3560-223-0x0000000000CEB000-0x0000000000DEC000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.0MB

                                                                                                                  Download

                                                                                                                • memory/3560-228-0x0000000000C20000-0x0000000000C7D000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  372KB

                                                                                                                  Download

                                                                                                                • memory/3820-336-0x0000000000400000-0x00000000008F8000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                  Download

                                                                                                                • memory/3820-326-0x0000000000A30000-0x0000000000B7A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.3MB

                                                                                                                  Download

                                                                                                                • memory/4196-340-0x0000000002604000-0x0000000002606000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                  Download

                                                                                                                • memory/4196-339-0x0000000002603000-0x0000000002604000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4196-334-0x0000000002600000-0x0000000002601000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4196-337-0x0000000000400000-0x000000000090A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                  Download

                                                                                                                • memory/4196-335-0x0000000002602000-0x0000000002603000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4196-332-0x0000000000AA0000-0x0000000000ACF000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  188KB

                                                                                                                  Download

                                                                                                                • memory/4400-258-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4400-264-0x0000000004C60000-0x0000000004C70000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                  Download

                                                                                                                • memory/4400-266-0x000000000DB50000-0x000000000DB51000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4400-282-0x0000000002590000-0x0000000002591000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4400-249-0x00000000004A0000-0x00000000004A1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4580-131-0x0000000002250000-0x000000000225F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  60KB

                                                                                                                  Download

                                                                                                                • memory/4664-352-0x000001DA02920000-0x000001DA0293B000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  108KB

                                                                                                                  Download

                                                                                                                • memory/4664-353-0x000001DA03900000-0x000001DA03A06000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.0MB

                                                                                                                  Download

                                                                                                                • memory/4664-243-0x000001DA01100000-0x000001DA01171000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                  Download

                                                                                                                • memory/4740-285-0x00000000057C0000-0x00000000057C1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4740-271-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  120KB

                                                                                                                  Download

                                                                                                                • memory/4740-293-0x00000000057E0000-0x00000000057E1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4740-287-0x0000000005860000-0x0000000005861000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4740-283-0x0000000005E70000-0x0000000005E71000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4740-297-0x0000000005850000-0x0000000005851000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4828-327-0x0000000000400000-0x000000000094D000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.3MB

                                                                                                                  Download

                                                                                                                • memory/4828-324-0x0000000002560000-0x00000000025FD000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  628KB

                                                                                                                  Download

                                                                                                                • memory/4944-265-0x0000000000A70000-0x0000000000A71000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4944-303-0x0000000005360000-0x0000000005361000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4944-280-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4984-267-0x00000000053B0000-0x00000000053E1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  196KB

                                                                                                                  Download

                                                                                                                • memory/4984-247-0x0000000005490000-0x0000000005491000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4984-237-0x0000000000B80000-0x0000000000B81000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4984-270-0x0000000007B20000-0x0000000007B21000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/5320-351-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/5684-342-0x0000000000400000-0x00000000004BA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  744KB

                                                                                                                  Download

                                                                                                                • memory/5684-341-0x00000000020F0000-0x000000000218D000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  628KB

                                                                                                                  Download

                                                                                                                • memory/5692-358-0x0000000005760000-0x0000000005D66000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.0MB

                                                                                                                  Download

                                                                                                                • memory/5716-357-0x0000000000400000-0x00000000004A1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  644KB

                                                                                                                  Download

                                                                                                                • memory/5732-331-0x0000000003030000-0x0000000003031000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/5732-320-0x0000000077D20000-0x0000000077EAE000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.6MB

                                                                                                                  Download

                                                                                                                • memory/5824-350-0x0000000000400000-0x0000000000472000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  456KB

                                                                                                                  Download

                                                                                                                • memory/5824-349-0x0000000002090000-0x00000000020BF000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  188KB

                                                                                                                  Download

                                                                                                                • memory/5888-329-0x00000000053B0000-0x00000000058AE000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                  Download

                                                                                                                • memory/5928-338-0x00000000058A0000-0x0000000005D9E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                  Download

                                                                                                                • memory/6044-333-0x0000000005460000-0x000000000595E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                  Download