elysiumstealer | 6814143c59108c0010bd29365823a38f61062a1978987b4798671334aa496740

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2424320fd3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2424320fd3.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	689f2a8e13ce6.exe

Loads dropped DLL 6 IoCs

pid	Process
756	setup_install.exe
756	setup_install.exe
756	setup_install.exe
756	setup_install.exe
756	setup_install.exe
756	setup_install.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6276	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000100000001ab4b-167.dat	themida
behavioral2/files/0x000100000001ab4b-165.dat	themida
behavioral2/memory/64-179-0x00000000011C0000-0x00000000011C1000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	2088712.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2424320fd3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ipinfo.io
37	ip-api.com
224	api.2ip.ua
225	api.2ip.ua
12	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
64	2424320fd3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 24 IoCs

pid	pid_target	Process	procid_target
1508	4776	WerFault.exe	109
4224	904	WerFault.exe	89
4212	2040	WerFault.exe	112
4240	2040	WerFault.exe	112
2340	2040	WerFault.exe	112
5176	4436	WerFault.exe	130
5204	2040	WerFault.exe	112
5280	2040	WerFault.exe	112
5352	4436	WerFault.exe	130
5628	4436	WerFault.exe	130
5876	4436	WerFault.exe	130
5792	4784	WerFault.exe	119
6128	4784	WerFault.exe	119
5124	2040	WerFault.exe	112
4156	4436	WerFault.exe	130
4680	2040	WerFault.exe	112
5576	4784	WerFault.exe	119
4572	2040	WerFault.exe	112
3572	4784	WerFault.exe	119
5952	4784	WerFault.exe	119
4020	4784	WerFault.exe	119
1824	4436	WerFault.exe	130
6052	4436	WerFault.exe	130
5696	4304	WerFault.exe	195

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7529e76a5fb92d7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7529e76a5fb92d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7529e76a5fb92d7.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
5412	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
6368	timeout.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
5424	taskkill.exe
5148	taskkill.exe
6228	taskkill.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	28	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
4040	689f2a8e13ce6.exe
3988	7529e76a5fb92d7.exe
3988	7529e76a5fb92d7.exe
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3988	7529e76a5fb92d7.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	bee7625d7f3708.exe
Token: SeDebugPrivilege	492	aea4d300485.exe
Token: SeDebugPrivilege	3736	6380851.exe
Token: SeDebugPrivilege	4200	4235095.exe
Token: SeCreateTokenPrivilege	4568	askinstall54.exe
Token: SeAssignPrimaryTokenPrivilege	4568	askinstall54.exe
Token: SeLockMemoryPrivilege	4568	askinstall54.exe
Token: SeIncreaseQuotaPrivilege	4568	askinstall54.exe
Token: SeMachineAccountPrivilege	4568	askinstall54.exe
Token: SeTcbPrivilege	4568	askinstall54.exe
Token: SeSecurityPrivilege	4568	askinstall54.exe
Token: SeTakeOwnershipPrivilege	4568	askinstall54.exe
Token: SeLoadDriverPrivilege	4568	askinstall54.exe
Token: SeSystemProfilePrivilege	4568	askinstall54.exe
Token: SeSystemtimePrivilege	4568	askinstall54.exe
Token: SeProfSingleProcessPrivilege	4568	askinstall54.exe
Token: SeIncBasePriorityPrivilege	4568	askinstall54.exe
Token: SeCreatePagefilePrivilege	4568	askinstall54.exe
Token: SeCreatePermanentPrivilege	4568	askinstall54.exe
Token: SeBackupPrivilege	4568	askinstall54.exe
Token: SeRestorePrivilege	4568	askinstall54.exe
Token: SeShutdownPrivilege	4568	askinstall54.exe
Token: SeDebugPrivilege	4568	askinstall54.exe
Token: SeAuditPrivilege	4568	askinstall54.exe
Token: SeSystemEnvironmentPrivilege	4568	askinstall54.exe
Token: SeChangeNotifyPrivilege	4568	askinstall54.exe
Token: SeRemoteShutdownPrivilege	4568	askinstall54.exe
Token: SeUndockPrivilege	4568	askinstall54.exe
Token: SeSyncAgentPrivilege	4568	askinstall54.exe
Token: SeEnableDelegationPrivilege	4568	askinstall54.exe
Token: SeManageVolumePrivilege	4568	askinstall54.exe
Token: SeImpersonatePrivilege	4568	askinstall54.exe
Token: SeCreateGlobalPrivilege	4568	askinstall54.exe
Token: 31	4568	askinstall54.exe
Token: 32	4568	askinstall54.exe
Token: 33	4568	askinstall54.exe
Token: 34	4568	askinstall54.exe
Token: 35	4568	askinstall54.exe
Token: SeDebugPrivilege	4776	dcc7975c8a99514da06323f0994cd79b.exe
Token: SeDebugPrivilege	64	2424320fd3.exe
Token: SeDebugPrivilege	4128	2254907.exe
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeDebugPrivilege	5080	NGlorySetp.exe
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeDebugPrivilege	1144	BearVpn 3.exe
Token: SeDebugPrivilege	1508	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 3200	992	af01213c_ApfpjrvTmZ.exe	75
PID 992 wrote to memory of 3200	992	af01213c_ApfpjrvTmZ.exe	75
PID 992 wrote to memory of 3200	992	af01213c_ApfpjrvTmZ.exe	75
PID 3200 wrote to memory of 756	3200	setup_installer.exe	76
PID 3200 wrote to memory of 756	3200	setup_installer.exe	76
PID 3200 wrote to memory of 756	3200	setup_installer.exe	76
PID 756 wrote to memory of 1852	756	setup_install.exe	79
PID 756 wrote to memory of 1852	756	setup_install.exe	79
PID 756 wrote to memory of 1852	756	setup_install.exe	79
PID 756 wrote to memory of 1300	756	setup_install.exe	80
PID 756 wrote to memory of 1300	756	setup_install.exe	80
PID 756 wrote to memory of 1300	756	setup_install.exe	80
PID 756 wrote to memory of 1276	756	setup_install.exe	81
PID 756 wrote to memory of 1276	756	setup_install.exe	81
PID 756 wrote to memory of 1276	756	setup_install.exe	81
PID 756 wrote to memory of 2100	756	setup_install.exe	82
PID 756 wrote to memory of 2100	756	setup_install.exe	82
PID 756 wrote to memory of 2100	756	setup_install.exe	82
PID 756 wrote to memory of 3696	756	setup_install.exe	83
PID 756 wrote to memory of 3696	756	setup_install.exe	83
PID 756 wrote to memory of 3696	756	setup_install.exe	83
PID 756 wrote to memory of 1212	756	setup_install.exe	87
PID 756 wrote to memory of 1212	756	setup_install.exe	87
PID 756 wrote to memory of 1212	756	setup_install.exe	87
PID 756 wrote to memory of 564	756	setup_install.exe	84
PID 756 wrote to memory of 564	756	setup_install.exe	84
PID 756 wrote to memory of 564	756	setup_install.exe	84
PID 756 wrote to memory of 416	756	setup_install.exe	86
PID 756 wrote to memory of 416	756	setup_install.exe	86
PID 756 wrote to memory of 416	756	setup_install.exe	86
PID 756 wrote to memory of 2344	756	setup_install.exe	85
PID 756 wrote to memory of 2344	756	setup_install.exe	85
PID 756 wrote to memory of 2344	756	setup_install.exe	85
PID 1852 wrote to memory of 3836	1852	cmd.exe	88
PID 1852 wrote to memory of 3836	1852	cmd.exe	88
PID 1300 wrote to memory of 904	1300	cmd.exe	89
PID 1300 wrote to memory of 904	1300	cmd.exe	89
PID 1300 wrote to memory of 904	1300	cmd.exe	89
PID 3696 wrote to memory of 492	3696	cmd.exe	91
PID 3696 wrote to memory of 492	3696	cmd.exe	91
PID 1212 wrote to memory of 3988	1212	cmd.exe	90
PID 1212 wrote to memory of 3988	1212	cmd.exe	90
PID 1212 wrote to memory of 3988	1212	cmd.exe	90
PID 2344 wrote to memory of 3152	2344	cmd.exe	95
PID 2344 wrote to memory of 3152	2344	cmd.exe	95
PID 2344 wrote to memory of 3152	2344	cmd.exe	95
PID 564 wrote to memory of 4040	564	cmd.exe	94
PID 564 wrote to memory of 4040	564	cmd.exe	94
PID 564 wrote to memory of 4040	564	cmd.exe	94
PID 2100 wrote to memory of 64	2100	cmd.exe	93
PID 2100 wrote to memory of 64	2100	cmd.exe	93
PID 2100 wrote to memory of 64	2100	cmd.exe	93
PID 3152 wrote to memory of 4020	3152	228d434d1f139.exe	96
PID 3152 wrote to memory of 4020	3152	228d434d1f139.exe	96
PID 3152 wrote to memory of 4020	3152	228d434d1f139.exe	96
PID 492 wrote to memory of 3736	492	aea4d300485.exe	98
PID 492 wrote to memory of 3736	492	aea4d300485.exe	98
PID 492 wrote to memory of 3956	492	aea4d300485.exe	103
PID 492 wrote to memory of 3956	492	aea4d300485.exe	103
PID 492 wrote to memory of 3956	492	aea4d300485.exe	103
PID 3264 wrote to memory of 4100	3264	bee7625d7f3708.exe	99
PID 3264 wrote to memory of 4100	3264	bee7625d7f3708.exe	99
PID 3264 wrote to memory of 4100	3264	bee7625d7f3708.exe	99
PID 492 wrote to memory of 4128	492	aea4d300485.exe	102

C:\Users\Admin\AppData\Local\Temp\af01213c_ApfpjrvTmZ.exe
"C:\Users\Admin\AppData\Local\Temp\af01213c_ApfpjrvTmZ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 824f4766e821701.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\824f4766e821701.exe
        
        824f4766e821701.exe
        5⤵
        Executes dropped EXE
        
        PID:3836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 41e718b8b1c32.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\41e718b8b1c32.exe
        
        41e718b8b1c32.exe
        5⤵
        Executes dropped EXE
        
        PID:904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 904
        6⤵
        Program crash
        
        PID:4224
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c APPNAME44.exe
      4⤵
      PID:1276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 2424320fd3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\2424320fd3.exe
        
        2424320fd3.exe
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:64
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c aea4d300485.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\aea4d300485.exe
        
        aea4d300485.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:492
      - C:\Users\Admin\AppData\Roaming\6380851.exe
        
        "C:\Users\Admin\AppData\Roaming\6380851.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3736
      - C:\Users\Admin\AppData\Roaming\4235095.exe
        
        "C:\Users\Admin\AppData\Roaming\4235095.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4200
      - C:\Users\Admin\AppData\Roaming\2254907.exe
        
        "C:\Users\Admin\AppData\Roaming\2254907.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
      - C:\Users\Admin\AppData\Roaming\2088712.exe
        
        "C:\Users\Admin\AppData\Roaming\2088712.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3956
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:4672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 689f2a8e13ce6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\689f2a8e13ce6.exe
        
        689f2a8e13ce6.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        
        PID:4040
      - C:\Users\Admin\Documents\zvlTDcs1ELqd7ZO2uLxqNwHQ.exe
        
        "C:\Users\Admin\Documents\zvlTDcs1ELqd7ZO2uLxqNwHQ.exe"
        6⤵
        Executes dropped EXE
        
        PID:4788
      - C:\Users\Admin\Documents\e0ihbBB0D0vRn10vv9DUZhha.exe
        
        "C:\Users\Admin\Documents\e0ihbBB0D0vRn10vv9DUZhha.exe"
        6⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 764
        7⤵
        Program crash
        
        PID:5792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 784
        7⤵
        Program crash
        
        PID:6128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 824
        7⤵
        Program crash
        
        PID:5576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 956
        7⤵
        Program crash
        
        PID:3572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 984
        7⤵
        Program crash
        
        PID:5952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 1008
        7⤵
        Program crash
        
        PID:4020
      - C:\Users\Admin\Documents\X1JNUay38uH2F88zqWgf5nCw.exe
        
        "C:\Users\Admin\Documents\X1JNUay38uH2F88zqWgf5nCw.exe"
        6⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Users\Admin\Documents\X1JNUay38uH2F88zqWgf5nCw.exe
        
        C:\Users\Admin\Documents\X1JNUay38uH2F88zqWgf5nCw.exe
        7⤵
        
        PID:2220
      - C:\Users\Admin\Documents\2M7qZQHcn4FbYXswYEb5BN7n.exe
        
        "C:\Users\Admin\Documents\2M7qZQHcn4FbYXswYEb5BN7n.exe"
        6⤵
        Executes dropped EXE
        
        PID:5000
        
        C:\Users\Admin\Documents\2M7qZQHcn4FbYXswYEb5BN7n.exe
        
        C:\Users\Admin\Documents\2M7qZQHcn4FbYXswYEb5BN7n.exe
        7⤵
        
        PID:4828
      - C:\Users\Admin\Documents\rp0JROQnxAD2N2gZbd3rt7Ch.exe
        
        "C:\Users\Admin\Documents\rp0JROQnxAD2N2gZbd3rt7Ch.exe"
        6⤵
        Executes dropped EXE
        
        PID:4844
      - C:\Users\Admin\Documents\899E_x0UoLJL1IQFGcpvgq8z.exe
        
        "C:\Users\Admin\Documents\899E_x0UoLJL1IQFGcpvgq8z.exe"
        6⤵
        Executes dropped EXE
        
        PID:4176
      - C:\Users\Admin\Documents\otSeAujKe0d3PUFVyEQ67Svi.exe
        
        "C:\Users\Admin\Documents\otSeAujKe0d3PUFVyEQ67Svi.exe"
        6⤵
        Executes dropped EXE
        
        PID:4564
      - C:\Users\Admin\Documents\tSyNVOD5RNxqtntkjuhwRMPB.exe
        
        "C:\Users\Admin\Documents\tSyNVOD5RNxqtntkjuhwRMPB.exe"
        6⤵
        
        PID:4332
      - C:\Users\Admin\Documents\p3wBrwKVybupJxLBfu3fq2Sk.exe
        
        "C:\Users\Admin\Documents\p3wBrwKVybupJxLBfu3fq2Sk.exe"
        6⤵
        
        PID:4424
        
        C:\Program Files (x86)\Company\NewProduct\customer3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:6516
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        7⤵
        
        PID:5748
        
        C:\Program Files (x86)\Company\NewProduct\jooyu.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6156
      - C:\Users\Admin\Documents\_lWcSsPiORQV69di2ZZOiKUb.exe
        
        "C:\Users\Admin\Documents\_lWcSsPiORQV69di2ZZOiKUb.exe"
        6⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im _lWcSsPiORQV69di2ZZOiKUb.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\_lWcSsPiORQV69di2ZZOiKUb.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im _lWcSsPiORQV69di2ZZOiKUb.exe /f
        8⤵
        Kills process with taskkill
        
        PID:6228
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:6368
      - C:\Users\Admin\Documents\kl6Bz7oCedVxzKAMfter1m6v.exe
        
        "C:\Users\Admin\Documents\kl6Bz7oCedVxzKAMfter1m6v.exe"
        6⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 660
        7⤵
        Program crash
        
        PID:5176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 672
        7⤵
        Program crash
        
        PID:5352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 720
        7⤵
        Program crash
        
        PID:5628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 812
        7⤵
        Program crash
        
        PID:5876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 888
        7⤵
        Program crash
        
        PID:4156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 1164
        7⤵
        Program crash
        
        PID:1824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 1128
        7⤵
        Program crash
        
        PID:6052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "kl6Bz7oCedVxzKAMfter1m6v.exe" /f & erase "C:\Users\Admin\Documents\kl6Bz7oCedVxzKAMfter1m6v.exe" & exit
        7⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "kl6Bz7oCedVxzKAMfter1m6v.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:5148
      - C:\Users\Admin\Documents\2PkqoHNdRb9oBGz3Xf4xVThV.exe
        
        "C:\Users\Admin\Documents\2PkqoHNdRb9oBGz3Xf4xVThV.exe"
        6⤵
        
        PID:1540
        
        C:\Users\Admin\Documents\2PkqoHNdRb9oBGz3Xf4xVThV.exe
        
        "C:\Users\Admin\Documents\2PkqoHNdRb9oBGz3Xf4xVThV.exe"
        7⤵
        
        PID:1680
      - C:\Users\Admin\Documents\pdVcZK0wQKmnjfZNvABKrRKl.exe
        
        "C:\Users\Admin\Documents\pdVcZK0wQKmnjfZNvABKrRKl.exe"
        6⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:6796
      - C:\Users\Admin\Documents\IQmkSE2AVEeB0Ufib1B1Bi3p.exe
        
        "C:\Users\Admin\Documents\IQmkSE2AVEeB0Ufib1B1Bi3p.exe"
        6⤵
        
        PID:4228
      - C:\Users\Admin\Documents\g322VpG3iWwDa6kRIPEBIVzR.exe
        
        "C:\Users\Admin\Documents\g322VpG3iWwDa6kRIPEBIVzR.exe"
        6⤵
        
        PID:4340
        
        C:\Users\Admin\Documents\g322VpG3iWwDa6kRIPEBIVzR.exe
        
        "C:\Users\Admin\Documents\g322VpG3iWwDa6kRIPEBIVzR.exe"
        7⤵
        
        PID:6336
      - C:\Users\Admin\Documents\d_Js96T8GDFS7qB4siOBdVIY.exe
        
        "C:\Users\Admin\Documents\d_Js96T8GDFS7qB4siOBdVIY.exe"
        6⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Roaming\3924328.exe
        
        "C:\Users\Admin\AppData\Roaming\3924328.exe"
        7⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Roaming\4683754.exe
        
        "C:\Users\Admin\AppData\Roaming\4683754.exe"
        7⤵
        
        PID:4680
      - C:\Users\Admin\Documents\Ncpfvp0flMfn4nfGE9l8U34x.exe
        
        "C:\Users\Admin\Documents\Ncpfvp0flMfn4nfGE9l8U34x.exe"
        6⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Roaming\3618981.exe
        
        "C:\Users\Admin\AppData\Roaming\3618981.exe"
        7⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Roaming\5521174.exe
        
        "C:\Users\Admin\AppData\Roaming\5521174.exe"
        7⤵
        
        PID:5188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 228d434d1f139.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\228d434d1f139.exe
        
        228d434d1f139.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\228d434d1f139.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\228d434d1f139.exe" -a
        6⤵
        Executes dropped EXE
        
        PID:4020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bee7625d7f3708.exe
      4⤵
      PID:416
    - - C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\bee7625d7f3708.exe
        
        bee7625d7f3708.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        7⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:5716
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:5412
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
        
        "C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        8⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        9⤵
        Kills process with taskkill
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4776 -s 1528
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
        
        C:\Users\Admin\AppData\Roaming\6707195.exe
        
        "C:\Users\Admin\AppData\Roaming\6707195.exe"
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Roaming\8469609.exe
        
        "C:\Users\Admin\AppData\Roaming\8469609.exe"
        8⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Roaming\7326841.exe
        
        "C:\Users\Admin\AppData\Roaming\7326841.exe"
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Roaming\4482817.exe
        
        "C:\Users\Admin\AppData\Roaming\4482817.exe"
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:2040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 800
        8⤵
        Program crash
        
        PID:4212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 876
        8⤵
        Program crash
        
        PID:4240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 884
        8⤵
        Program crash
        
        PID:2340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 960
        8⤵
        Program crash
        
        PID:5204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 912
        8⤵
        Program crash
        
        PID:5280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1136
        8⤵
        Program crash
        
        PID:5124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1212
        8⤵
        Program crash
        
        PID:4680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1136
        8⤵
        Program crash
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 7529e76a5fb92d7.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\7zS08C353A4\7529e76a5fb92d7.exe
        
        7529e76a5fb92d7.exe
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3988

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5200

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 624
    3⤵
    - Program crash
    PID:5696

C:\Users\Admin\AppData\Local\Temp\997D.exe
C:\Users\Admin\AppData\Local\Temp\997D.exe
1⤵
PID:6600
- C:\Users\Admin\AppData\Local\Temp\997D.exe
  C:\Users\Admin\AppData\Local\Temp\997D.exe
  2⤵
  PID:6836
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\fc1e554a-643d-4f6f-b96d-fc4020415318" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:6276

C:\Users\Admin\AppData\Local\Temp\A739.exe
C:\Users\Admin\AppData\Local\Temp\A739.exe
1⤵
PID:4524

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:6116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery