glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

Processes:

KM7vM9_g3xuQy9jjBT7qxjhi.exeQFDNNW8Y4Z5iflEMcJE4jcjt.exeuueth1xgT9zSREHL44UZTXL9.exenkv02qk9205_ar_KFbqrigdO.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KM7vM9_g3xuQy9jjBT7qxjhi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KM7vM9_g3xuQy9jjBT7qxjhi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	uueth1xgT9zSREHL44UZTXL9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	uueth1xgT9zSREHL44UZTXL9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nkv02qk9205_ar_KFbqrigdO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nkv02qk9205_ar_KFbqrigdO.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Setup (16).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation	Setup (16).exe

Loads dropped DLL 44 IoCs

Processes:

Setup (16).exeWerFault.exe7843145.exeiYzNV8Mx6AO2LOfx_GsDaw_r.exe

pid	process
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
1244	Setup (16).exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2784	7843145.exe
2708	WerFault.exe
1624	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
1624	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
1624	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
1624	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
1624	iYzNV8Mx6AO2LOfx_GsDaw_r.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\QFDNNW8Y4Z5iflEMcJE4jcjt.exe	themida
\Users\Admin\Documents\QFDNNW8Y4Z5iflEMcJE4jcjt.exe	themida
\Users\Admin\Documents\uueth1xgT9zSREHL44UZTXL9.exe	themida
C:\Users\Admin\Documents\uueth1xgT9zSREHL44UZTXL9.exe	themida
\Users\Admin\Documents\nkv02qk9205_ar_KFbqrigdO.exe	themida
C:\Users\Admin\Documents\nkv02qk9205_ar_KFbqrigdO.exe	themida
\Users\Admin\Documents\KM7vM9_g3xuQy9jjBT7qxjhi.exe	themida
C:\Users\Admin\Documents\KM7vM9_g3xuQy9jjBT7qxjhi.exe	themida
behavioral15/memory/520-185-0x00000000012E0000-0x00000000012E1000-memory.dmp	themida
behavioral15/memory/1804-204-0x00000000009F0000-0x00000000009F1000-memory.dmp	themida
behavioral15/memory/792-234-0x0000000001250000-0x0000000001251000-memory.dmp	themida
behavioral15/memory/992-245-0x0000000001060000-0x0000000001061000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7843145.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	7843145.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

Processes:

KM7vM9_g3xuQy9jjBT7qxjhi.exeQFDNNW8Y4Z5iflEMcJE4jcjt.exeuueth1xgT9zSREHL44UZTXL9.exenkv02qk9205_ar_KFbqrigdO.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	KM7vM9_g3xuQy9jjBT7qxjhi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uueth1xgT9zSREHL44UZTXL9.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nkv02qk9205_ar_KFbqrigdO.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
22	ipinfo.io
221	ipinfo.io
404	ipinfo.io
408	ipinfo.io
467	ipinfo.io
21	ipinfo.io
188	ip-api.com
219	ipinfo.io
264	ipinfo.io
266	ipinfo.io
270	ipinfo.io
469	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

KM7vM9_g3xuQy9jjBT7qxjhi.exeQFDNNW8Y4Z5iflEMcJE4jcjt.exeuueth1xgT9zSREHL44UZTXL9.exenkv02qk9205_ar_KFbqrigdO.exe

pid process

520 KM7vM9_g3xuQy9jjBT7qxjhi.exe
1804 QFDNNW8Y4Z5iflEMcJE4jcjt.exe
792 uueth1xgT9zSREHL44UZTXL9.exe
992 nkv02qk9205_ar_KFbqrigdO.exe

pid	process
520	KM7vM9_g3xuQy9jjBT7qxjhi.exe
1804	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
792	uueth1xgT9zSREHL44UZTXL9.exe
992	nkv02qk9205_ar_KFbqrigdO.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exewCDdWRdSk3GiSRGAlHUL9qAo.exe

description	pid	process	target process
PID 908 set thread context of 2568	908	Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe	Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe
PID 1576 set thread context of 2560	1576	wCDdWRdSk3GiSRGAlHUL9qAo.exe	wCDdWRdSk3GiSRGAlHUL9qAo.exe

Drops file in Program Files directory 5 IoCs

Processes:

iYzNV8Mx6AO2LOfx_GsDaw_r.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	iYzNV8Mx6AO2LOfx_GsDaw_r.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2708	588	WerFault.exe	WVsiEgPsuqJyJFNF4AWSNTyf.exe
1280	2136	WerFault.exe	6563361.exe
940	2612	WerFault.exe	3558891.exe
3100	3404	WerFault.exe	M5tQTgbYDhxyWh20jHtXEqAg.exe
5088	4276	WerFault.exe	FA49.exe
4764	2776	WerFault.exe	5397589.exe
4968	3036	WerFault.exe	2452615.exe
3300	2820	WerFault.exe	2972050.exe
2728	1156	WerFault.exe	8457613.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

bX7sixkQmvGTKj8tYzA2JD7w.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bX7sixkQmvGTKj8tYzA2JD7w.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bX7sixkQmvGTKj8tYzA2JD7w.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bX7sixkQmvGTKj8tYzA2JD7w.exe

Creates scheduled task(s) 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3572	schtasks.exe
1964	schtasks.exe
2608	schtasks.exe
2960	schtasks.exe
900	schtasks.exe
2684	schtasks.exe
616	schtasks.exe
3092	schtasks.exe
4068	schtasks.exe
2172	schtasks.exe
2836	schtasks.exe
3492	schtasks.exe
3692	schtasks.exe
1960	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5008 timeout.exe
Kills process with taskkill 5 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2236 taskkill.exe
632 taskkill.exe
3040 taskkill.exe
4180 taskkill.exe
1072 taskkill.exe

pid	process
5008	timeout.exe

pid	process
2236	taskkill.exe
632	taskkill.exe
3040	taskkill.exe
4180	taskkill.exe
1072	taskkill.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Setup (16).exeWVsiEgPsuqJyJFNF4AWSNTyf.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Setup (16).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (16).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Setup (16).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Setup (16).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (16).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	WVsiEgPsuqJyJFNF4AWSNTyf.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	WVsiEgPsuqJyJFNF4AWSNTyf.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	WVsiEgPsuqJyJFNF4AWSNTyf.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2016 PING.EXE

pid	process
2016	PING.EXE

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	268	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	407	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	410	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	468	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	220	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	223	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Setup (16).exeWerFault.exeIa3bS7Ge4dDbvHlHTQ0FDGCZ.exebX7sixkQmvGTKj8tYzA2JD7w.exeQFDNNW8Y4Z5iflEMcJE4jcjt.exe

pid	process
1244	Setup (16).exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2568	Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe
2008	bX7sixkQmvGTKj8tYzA2JD7w.exe
2008	bX7sixkQmvGTKj8tYzA2JD7w.exe
1804	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1804	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bX7sixkQmvGTKj8tYzA2JD7w.exe

pid process

2008 bX7sixkQmvGTKj8tYzA2JD7w.exe

pid	process
2008	bX7sixkQmvGTKj8tYzA2JD7w.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

DRQBAC9qpUOGsVu1doxrhNcC.exeKNJlIS2IgAVTu5ku4GV0YSlu.exe3558891.exeWerFault.exewCDdWRdSk3GiSRGAlHUL9qAo.exeQFDNNW8Y4Z5iflEMcJE4jcjt.exeIa3bS7Ge4dDbvHlHTQ0FDGCZ.exe6563361.exevs1mlBAD6CaBs9Kg_j31IA7A.exeuueth1xgT9zSREHL44UZTXL9.exetaskkill.exe2471901.exenkv02qk9205_ar_KFbqrigdO.exe

description	pid	process
Token: SeDebugPrivilege	1140	DRQBAC9qpUOGsVu1doxrhNcC.exe
Token: SeDebugPrivilege	960	KNJlIS2IgAVTu5ku4GV0YSlu.exe
Token: SeDebugPrivilege	2612	3558891.exe
Token: SeDebugPrivilege	2708	WerFault.exe
Token: SeDebugPrivilege	520
Token: SeDebugPrivilege	2560	wCDdWRdSk3GiSRGAlHUL9qAo.exe
Token: SeDebugPrivilege	1804	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
Token: SeDebugPrivilege	2568	Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe
Token: SeDebugPrivilege	2136	6563361.exe
Token: SeDebugPrivilege	968	vs1mlBAD6CaBs9Kg_j31IA7A.exe
Token: SeDebugPrivilege	792	uueth1xgT9zSREHL44UZTXL9.exe
Token: SeDebugPrivilege	2236	taskkill.exe
Token: SeDebugPrivilege	2856	2471901.exe
Token: SeDebugPrivilege	992	nkv02qk9205_ar_KFbqrigdO.exe
Token: SeShutdownPrivilege	1196

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup (16).exe

description	pid	process	target process
PID 1244 wrote to memory of 1652	1244	Setup (16).exe	IFAWudtoNDNrLQ84BCOnuseb.exe
PID 1244 wrote to memory of 1652	1244	Setup (16).exe	IFAWudtoNDNrLQ84BCOnuseb.exe
PID 1244 wrote to memory of 1652	1244	Setup (16).exe	IFAWudtoNDNrLQ84BCOnuseb.exe
PID 1244 wrote to memory of 1652	1244	Setup (16).exe	IFAWudtoNDNrLQ84BCOnuseb.exe
PID 1244 wrote to memory of 1156	1244	Setup (16).exe	W08JOLI7AWfDE9LcTIE91hsc.exe
PID 1244 wrote to memory of 1156	1244	Setup (16).exe	W08JOLI7AWfDE9LcTIE91hsc.exe
PID 1244 wrote to memory of 1156	1244	Setup (16).exe	W08JOLI7AWfDE9LcTIE91hsc.exe
PID 1244 wrote to memory of 1156	1244	Setup (16).exe	W08JOLI7AWfDE9LcTIE91hsc.exe
PID 1244 wrote to memory of 908	1244	Setup (16).exe	Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe
PID 1244 wrote to memory of 908	1244	Setup (16).exe	Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe
PID 1244 wrote to memory of 908	1244	Setup (16).exe	Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe
PID 1244 wrote to memory of 908	1244	Setup (16).exe	Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe
PID 1244 wrote to memory of 1804	1244	Setup (16).exe	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
PID 1244 wrote to memory of 1804	1244	Setup (16).exe	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
PID 1244 wrote to memory of 1804	1244	Setup (16).exe	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
PID 1244 wrote to memory of 1804	1244	Setup (16).exe	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
PID 1244 wrote to memory of 1804	1244	Setup (16).exe	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
PID 1244 wrote to memory of 1804	1244	Setup (16).exe	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
PID 1244 wrote to memory of 1804	1244	Setup (16).exe	QFDNNW8Y4Z5iflEMcJE4jcjt.exe
PID 1244 wrote to memory of 1576	1244	Setup (16).exe	wCDdWRdSk3GiSRGAlHUL9qAo.exe
PID 1244 wrote to memory of 1576	1244	Setup (16).exe	wCDdWRdSk3GiSRGAlHUL9qAo.exe
PID 1244 wrote to memory of 1576	1244	Setup (16).exe	wCDdWRdSk3GiSRGAlHUL9qAo.exe
PID 1244 wrote to memory of 1576	1244	Setup (16).exe	wCDdWRdSk3GiSRGAlHUL9qAo.exe
PID 1244 wrote to memory of 1568	1244	Setup (16).exe	T6G2WrCnLfV7V75RgAK9xD10.exe
PID 1244 wrote to memory of 1568	1244	Setup (16).exe	T6G2WrCnLfV7V75RgAK9xD10.exe
PID 1244 wrote to memory of 1568	1244	Setup (16).exe	T6G2WrCnLfV7V75RgAK9xD10.exe
PID 1244 wrote to memory of 1568	1244	Setup (16).exe	T6G2WrCnLfV7V75RgAK9xD10.exe
PID 1244 wrote to memory of 792	1244	Setup (16).exe	uueth1xgT9zSREHL44UZTXL9.exe
PID 1244 wrote to memory of 792	1244	Setup (16).exe	uueth1xgT9zSREHL44UZTXL9.exe
PID 1244 wrote to memory of 792	1244	Setup (16).exe	uueth1xgT9zSREHL44UZTXL9.exe
PID 1244 wrote to memory of 792	1244	Setup (16).exe	uueth1xgT9zSREHL44UZTXL9.exe
PID 1244 wrote to memory of 792	1244	Setup (16).exe	uueth1xgT9zSREHL44UZTXL9.exe
PID 1244 wrote to memory of 792	1244	Setup (16).exe	uueth1xgT9zSREHL44UZTXL9.exe
PID 1244 wrote to memory of 792	1244	Setup (16).exe	uueth1xgT9zSREHL44UZTXL9.exe
PID 1244 wrote to memory of 2008	1244	Setup (16).exe	bX7sixkQmvGTKj8tYzA2JD7w.exe
PID 1244 wrote to memory of 2008	1244	Setup (16).exe	bX7sixkQmvGTKj8tYzA2JD7w.exe
PID 1244 wrote to memory of 2008	1244	Setup (16).exe	bX7sixkQmvGTKj8tYzA2JD7w.exe
PID 1244 wrote to memory of 2008	1244	Setup (16).exe	bX7sixkQmvGTKj8tYzA2JD7w.exe
PID 1244 wrote to memory of 1140	1244	Setup (16).exe	DRQBAC9qpUOGsVu1doxrhNcC.exe
PID 1244 wrote to memory of 1140	1244	Setup (16).exe	DRQBAC9qpUOGsVu1doxrhNcC.exe
PID 1244 wrote to memory of 1140	1244	Setup (16).exe	DRQBAC9qpUOGsVu1doxrhNcC.exe
PID 1244 wrote to memory of 1140	1244	Setup (16).exe	DRQBAC9qpUOGsVu1doxrhNcC.exe
PID 1244 wrote to memory of 588	1244	Setup (16).exe	WVsiEgPsuqJyJFNF4AWSNTyf.exe
PID 1244 wrote to memory of 588	1244	Setup (16).exe	WVsiEgPsuqJyJFNF4AWSNTyf.exe
PID 1244 wrote to memory of 588	1244	Setup (16).exe	WVsiEgPsuqJyJFNF4AWSNTyf.exe
PID 1244 wrote to memory of 588	1244	Setup (16).exe	WVsiEgPsuqJyJFNF4AWSNTyf.exe
PID 1244 wrote to memory of 960	1244	Setup (16).exe	KNJlIS2IgAVTu5ku4GV0YSlu.exe
PID 1244 wrote to memory of 960	1244	Setup (16).exe	KNJlIS2IgAVTu5ku4GV0YSlu.exe
PID 1244 wrote to memory of 960	1244	Setup (16).exe	KNJlIS2IgAVTu5ku4GV0YSlu.exe
PID 1244 wrote to memory of 960	1244	Setup (16).exe	KNJlIS2IgAVTu5ku4GV0YSlu.exe
PID 1244 wrote to memory of 992	1244	Setup (16).exe	nkv02qk9205_ar_KFbqrigdO.exe
PID 1244 wrote to memory of 992	1244	Setup (16).exe	nkv02qk9205_ar_KFbqrigdO.exe
PID 1244 wrote to memory of 992	1244	Setup (16).exe	nkv02qk9205_ar_KFbqrigdO.exe
PID 1244 wrote to memory of 992	1244	Setup (16).exe	nkv02qk9205_ar_KFbqrigdO.exe
PID 1244 wrote to memory of 992	1244	Setup (16).exe	nkv02qk9205_ar_KFbqrigdO.exe
PID 1244 wrote to memory of 992	1244	Setup (16).exe	nkv02qk9205_ar_KFbqrigdO.exe
PID 1244 wrote to memory of 992	1244	Setup (16).exe	nkv02qk9205_ar_KFbqrigdO.exe
PID 1244 wrote to memory of 1624	1244	Setup (16).exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
PID 1244 wrote to memory of 1624	1244	Setup (16).exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
PID 1244 wrote to memory of 1624	1244	Setup (16).exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
PID 1244 wrote to memory of 1624	1244	Setup (16).exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
PID 1244 wrote to memory of 1624	1244	Setup (16).exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
PID 1244 wrote to memory of 1624	1244	Setup (16).exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe
PID 1244 wrote to memory of 1624	1244	Setup (16).exe	iYzNV8Mx6AO2LOfx_GsDaw_r.exe

C:\Users\Admin\AppData\Local\Temp\Setup (16).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (16).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\Documents\IFAWudtoNDNrLQ84BCOnuseb.exe
"C:\Users\Admin\Documents\IFAWudtoNDNrLQ84BCOnuseb.exe"
2⤵
- Executes dropped EXE
PID:1652

C:\Users\Admin\Documents\W08JOLI7AWfDE9LcTIE91hsc.exe
"C:\Users\Admin\Documents\W08JOLI7AWfDE9LcTIE91hsc.exe"
2⤵
- Executes dropped EXE
PID:1156

C:\Users\Admin\Documents\uueth1xgT9zSREHL44UZTXL9.exe
"C:\Users\Admin\Documents\uueth1xgT9zSREHL44UZTXL9.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Users\Admin\Documents\iEgDnSWkOpvwf2CFVUStv58O.exe
"C:\Users\Admin\Documents\iEgDnSWkOpvwf2CFVUStv58O.exe"
2⤵
- Executes dropped EXE
PID:1828

C:\Users\Admin\Documents\T6G2WrCnLfV7V75RgAK9xD10.exe
"C:\Users\Admin\Documents\T6G2WrCnLfV7V75RgAK9xD10.exe"
2⤵
- Executes dropped EXE
PID:1568

C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\md8_8eus.exe
"C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\md8_8eus.exe"
3⤵
PID:2996

C:\Users\Admin\Documents\wCDdWRdSk3GiSRGAlHUL9qAo.exe
"C:\Users\Admin\Documents\wCDdWRdSk3GiSRGAlHUL9qAo.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1576

C:\Users\Admin\Documents\wCDdWRdSk3GiSRGAlHUL9qAo.exe
C:\Users\Admin\Documents\wCDdWRdSk3GiSRGAlHUL9qAo.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Users\Admin\Documents\QFDNNW8Y4Z5iflEMcJE4jcjt.exe
"C:\Users\Admin\Documents\QFDNNW8Y4Z5iflEMcJE4jcjt.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Users\Admin\Documents\Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe
"C:\Users\Admin\Documents\Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:908

C:\Users\Admin\Documents\Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe
C:\Users\Admin\Documents\Ia3bS7Ge4dDbvHlHTQ0FDGCZ.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Users\Admin\Documents\DRQBAC9qpUOGsVu1doxrhNcC.exe
"C:\Users\Admin\Documents\DRQBAC9qpUOGsVu1doxrhNcC.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Users\Admin\AppData\Roaming\3558891.exe
"C:\Users\Admin\AppData\Roaming\3558891.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2612 -s 1808
4⤵
- Program crash
PID:940

C:\Users\Admin\AppData\Roaming\7843145.exe
"C:\Users\Admin\AppData\Roaming\7843145.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2784

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
4⤵
- Executes dropped EXE
PID:3060

C:\Users\Admin\AppData\Roaming\2471901.exe
"C:\Users\Admin\AppData\Roaming\2471901.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Users\Admin\AppData\Roaming\6563361.exe
"C:\Users\Admin\AppData\Roaming\6563361.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 508
4⤵
- Program crash
PID:1280

C:\Users\Admin\Documents\bX7sixkQmvGTKj8tYzA2JD7w.exe
"C:\Users\Admin\Documents\bX7sixkQmvGTKj8tYzA2JD7w.exe"
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2008

C:\Users\Admin\Documents\WVsiEgPsuqJyJFNF4AWSNTyf.exe
"C:\Users\Admin\Documents\WVsiEgPsuqJyJFNF4AWSNTyf.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 780
3⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Users\Admin\Documents\Hx5REASR3FIrx3SuWwVa4VuP.exe
"C:\Users\Admin\Documents\Hx5REASR3FIrx3SuWwVa4VuP.exe"
2⤵
- Executes dropped EXE
PID:1628

C:\Users\Admin\Documents\Hx5REASR3FIrx3SuWwVa4VuP.exe
"C:\Users\Admin\Documents\Hx5REASR3FIrx3SuWwVa4VuP.exe"
3⤵
PID:4912

C:\Users\Admin\Documents\vYvhdSQ2V2Iexv11LEjlUKqp.exe
"C:\Users\Admin\Documents\vYvhdSQ2V2Iexv11LEjlUKqp.exe"
2⤵
- Executes dropped EXE
PID:1276

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\vYvhdSQ2V2Iexv11LEjlUKqp.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\vYvhdSQ2V2Iexv11LEjlUKqp.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
3⤵
PID:2168

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\vYvhdSQ2V2Iexv11LEjlUKqp.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\vYvhdSQ2V2Iexv11LEjlUKqp.exe") do taskkill -IM "%~nXW" -f
4⤵
PID:2980

C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
5⤵
PID:2320

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
6⤵
PID:1388

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
7⤵
PID:1816

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
6⤵
PID:2600

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "vYvhdSQ2V2Iexv11LEjlUKqp.exe" -f
5⤵
- Kills process with taskkill
PID:3040

C:\Users\Admin\Documents\KM7vM9_g3xuQy9jjBT7qxjhi.exe
"C:\Users\Admin\Documents\KM7vM9_g3xuQy9jjBT7qxjhi.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:520

C:\Users\Admin\Documents\vs1mlBAD6CaBs9Kg_j31IA7A.exe
"C:\Users\Admin\Documents\vs1mlBAD6CaBs9Kg_j31IA7A.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Users\Admin\Documents\Fw5boJe2kaqJ59J4J9qXfhTb.exe
"C:\Users\Admin\Documents\Fw5boJe2kaqJ59J4J9qXfhTb.exe"
2⤵
- Executes dropped EXE
PID:1656

C:\Users\Admin\AppData\Local\Temp\is-0UE0L.tmp\Fw5boJe2kaqJ59J4J9qXfhTb.tmp
"C:\Users\Admin\AppData\Local\Temp\is-0UE0L.tmp\Fw5boJe2kaqJ59J4J9qXfhTb.tmp" /SL5="$201EA,138429,56832,C:\Users\Admin\Documents\Fw5boJe2kaqJ59J4J9qXfhTb.exe"
3⤵
PID:2460

C:\Users\Admin\AppData\Local\Temp\is-HQM1E.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-HQM1E.tmp\Setup.exe" /Verysilent
4⤵
PID:616

C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
5⤵
PID:2636

C:\Users\Admin\AppData\Local\Temp\is-9P4K3.tmp\Stats.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9P4K3.tmp\Stats.tmp" /SL5="$102F8,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
6⤵
PID:988

C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
5⤵
PID:916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im runvd.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:3472

C:\Windows\SysWOW64\taskkill.exe
taskkill /im runvd.exe /f
7⤵
- Kills process with taskkill
PID:1072

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:5008

C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
5⤵
PID:2984

C:\Users\Admin\AppData\Local\Temp\is-8RLK7.tmp\Inlog.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8RLK7.tmp\Inlog.tmp" /SL5="$10306,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
6⤵
PID:3024

C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
5⤵
PID:2604

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629550570 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
6⤵
PID:4356

C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
5⤵
PID:2464

C:\Users\Admin\AppData\Local\Temp\is-J5EL2.tmp\WEATHER Manager.tmp
"C:\Users\Admin\AppData\Local\Temp\is-J5EL2.tmp\WEATHER Manager.tmp" /SL5="$30448,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
6⤵
PID:2420

C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
5⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\is-JD5NH.tmp\MediaBurner2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JD5NH.tmp\MediaBurner2.tmp" /SL5="$1035A,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
6⤵
PID:2860

C:\Users\Admin\AppData\Local\Temp\is-HO0M1.tmp\ultradumnibour.exe
"C:\Users\Admin\AppData\Local\Temp\is-HO0M1.tmp\ultradumnibour.exe" /S /UID=burnerch2
7⤵
PID:2792

C:\Program Files\VideoLAN\KCUDIZAAJW\ultramediaburner.exe
"C:\Program Files\VideoLAN\KCUDIZAAJW\ultramediaburner.exe" /VERYSILENT
8⤵
PID:4864

C:\Users\Admin\AppData\Local\Temp\is-CNA8R.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-CNA8R.tmp\ultramediaburner.tmp" /SL5="$4045C,281924,62464,C:\Program Files\VideoLAN\KCUDIZAAJW\ultramediaburner.exe" /VERYSILENT
9⤵
PID:4136

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
10⤵
PID:4316

C:\Users\Admin\AppData\Local\Temp\97-a3a70-80b-4099f-df3e00b5a9bf4\Nozhasuwujae.exe
"C:\Users\Admin\AppData\Local\Temp\97-a3a70-80b-4099f-df3e00b5a9bf4\Nozhasuwujae.exe"
8⤵
PID:4944

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
9⤵
PID:268

C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
5⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\is-HPLV5.tmp\VPN.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HPLV5.tmp\VPN.tmp" /SL5="$1035C,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
6⤵
PID:1244

C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
5⤵
PID:2200

C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
6⤵
PID:2652

C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
5⤵
PID:1440

C:\Users\Admin\AppData\Roaming\5397589.exe
"C:\Users\Admin\AppData\Roaming\5397589.exe"
6⤵
PID:2776

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2776 -s 1696
7⤵
- Program crash
PID:4764

C:\Users\Admin\AppData\Roaming\4023969.exe
"C:\Users\Admin\AppData\Roaming\4023969.exe"
6⤵
PID:3184

C:\Users\Admin\AppData\Roaming\8851128.exe
"C:\Users\Admin\AppData\Roaming\8851128.exe"
6⤵
PID:3824

C:\Users\Admin\AppData\Roaming\1985015.exe
"C:\Users\Admin\AppData\Roaming\1985015.exe"
6⤵
PID:2204

C:\Users\Admin\AppData\Roaming\2452615.exe
"C:\Users\Admin\AppData\Roaming\2452615.exe"
6⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1600
7⤵
- Program crash
PID:4968

C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
5⤵
PID:2720

C:\Users\Admin\AppData\Local\Temp\tmpE53_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpE53_tmp.exe"
6⤵
PID:1680

C:\Windows\SysWOW64\dllhost.exe
"C:\Windows\System32\dllhost.exe"
7⤵
PID:4548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks
7⤵
PID:3068

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:1136

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks
9⤵
PID:2180

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
Esplorarne.exe.com i
9⤵
PID:2488

C:\Windows\SysWOW64\PING.EXE
ping MRBKYMNO -n 30
9⤵
- Runs ping.exe
PID:2016

C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
5⤵
PID:3000

C:\Users\Admin\Documents\JoRzr3odUo7hyusj0jkeg8aH.exe
"C:\Users\Admin\Documents\JoRzr3odUo7hyusj0jkeg8aH.exe"
6⤵
PID:3208

C:\Users\Admin\Documents\bZWz5vvblsNb9bh02Kfzn1SS.exe
"C:\Users\Admin\Documents\bZWz5vvblsNb9bh02Kfzn1SS.exe"
6⤵
PID:3420

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\BZWZ5V~1.DLL,s C:\Users\Admin\DOCUME~1\BZWZ5V~1.EXE
7⤵
PID:4952

C:\Users\Admin\Documents\LAK0mnr1Do8wwQxgfGGpuSnE.exe
"C:\Users\Admin\Documents\LAK0mnr1Do8wwQxgfGGpuSnE.exe"
6⤵
PID:3532

C:\Users\Admin\AppData\Local\Temp\is-FNB3L.tmp\LAK0mnr1Do8wwQxgfGGpuSnE.tmp
"C:\Users\Admin\AppData\Local\Temp\is-FNB3L.tmp\LAK0mnr1Do8wwQxgfGGpuSnE.tmp" /SL5="$10372,138429,56832,C:\Users\Admin\Documents\LAK0mnr1Do8wwQxgfGGpuSnE.exe"
7⤵
PID:2252

C:\Users\Admin\Documents\sUe6hhPHy60AgfPqlK2eSNPH.exe
"C:\Users\Admin\Documents\sUe6hhPHy60AgfPqlK2eSNPH.exe"
6⤵
PID:3412

C:\Users\Admin\Documents\sUe6hhPHy60AgfPqlK2eSNPH.exe
"C:\Users\Admin\Documents\sUe6hhPHy60AgfPqlK2eSNPH.exe" -q
7⤵
PID:2528

C:\Users\Admin\Documents\M5tQTgbYDhxyWh20jHtXEqAg.exe
"C:\Users\Admin\Documents\M5tQTgbYDhxyWh20jHtXEqAg.exe"
6⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1312
7⤵
- Program crash
PID:3100

C:\Users\Admin\Documents\dZpvL1NVm_9ZLvZlJBVlPcDm.exe
"C:\Users\Admin\Documents\dZpvL1NVm_9ZLvZlJBVlPcDm.exe"
6⤵
PID:3396

C:\Users\Admin\Documents\yrneP3reEQDg67qOARAe6Hwe.exe
"C:\Users\Admin\Documents\yrneP3reEQDg67qOARAe6Hwe.exe"
6⤵
PID:3388

C:\Users\Admin\Documents\Yar_hoC8nVIq0sRSeG0wTnAQ.exe
"C:\Users\Admin\Documents\Yar_hoC8nVIq0sRSeG0wTnAQ.exe"
6⤵
PID:3380

C:\Users\Admin\AppData\Roaming\2972050.exe
"C:\Users\Admin\AppData\Roaming\2972050.exe"
7⤵
PID:2820

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2820 -s 1696
8⤵
- Program crash
PID:3300

C:\Users\Admin\AppData\Roaming\3605034.exe
"C:\Users\Admin\AppData\Roaming\3605034.exe"
7⤵
PID:3704

C:\Users\Admin\AppData\Roaming\1224666.exe
"C:\Users\Admin\AppData\Roaming\1224666.exe"
7⤵
PID:456

C:\Users\Admin\AppData\Roaming\8457613.exe
"C:\Users\Admin\AppData\Roaming\8457613.exe"
7⤵
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 844
8⤵
- Program crash
PID:2728

C:\Users\Admin\Documents\He42xLam0gOORyZYysCVqo5z.exe
"C:\Users\Admin\Documents\He42xLam0gOORyZYysCVqo5z.exe"
6⤵
PID:3368

C:\Users\Admin\Documents\He42xLam0gOORyZYysCVqo5z.exe
"C:\Users\Admin\Documents\He42xLam0gOORyZYysCVqo5z.exe"
7⤵
PID:3736

C:\Users\Admin\Documents\GGqNxtDi4QAVd9w45ZLFVOcz.exe
"C:\Users\Admin\Documents\GGqNxtDi4QAVd9w45ZLFVOcz.exe"
6⤵
PID:3356

C:\Users\Admin\Documents\86tbnApnxzEqqjPjHrPAu39w.exe
"C:\Users\Admin\Documents\86tbnApnxzEqqjPjHrPAu39w.exe"
6⤵
PID:3344

C:\Users\Admin\Documents\86tbnApnxzEqqjPjHrPAu39w.exe
"C:\Users\Admin\Documents\86tbnApnxzEqqjPjHrPAu39w.exe"
7⤵
PID:4604

C:\Users\Admin\Documents\X313XIVa3UEPdQ4hK1pI7xdP.exe
"C:\Users\Admin\Documents\X313XIVa3UEPdQ4hK1pI7xdP.exe"
6⤵
PID:3336

C:\Users\Admin\Documents\IxbjENRUfxrVcg3NJoa2doHN.exe
"C:\Users\Admin\Documents\IxbjENRUfxrVcg3NJoa2doHN.exe"
6⤵
PID:3324

C:\Users\Admin\Documents\uFR22Q6PSEo5b1BaqQQV_x76.exe
"C:\Users\Admin\Documents\uFR22Q6PSEo5b1BaqQQV_x76.exe"
6⤵
PID:3312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "uFR22Q6PSEo5b1BaqQQV_x76.exe" /f & erase "C:\Users\Admin\Documents\uFR22Q6PSEo5b1BaqQQV_x76.exe" & exit
7⤵
PID:3620

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "uFR22Q6PSEo5b1BaqQQV_x76.exe" /f
8⤵
- Kills process with taskkill
PID:4180

C:\Users\Admin\Documents\b6DMOdiSFp86eOHwz13yfm9H.exe
"C:\Users\Admin\Documents\b6DMOdiSFp86eOHwz13yfm9H.exe"
6⤵
PID:3296

C:\Users\Admin\Documents\b6DMOdiSFp86eOHwz13yfm9H.exe
C:\Users\Admin\Documents\b6DMOdiSFp86eOHwz13yfm9H.exe
7⤵
PID:3888

C:\Users\Admin\Documents\sQE5BDTauRI8cWYIkPXMcmVm.exe
"C:\Users\Admin\Documents\sQE5BDTauRI8cWYIkPXMcmVm.exe"
6⤵
PID:3284

C:\Users\Admin\Documents\OzVvQBKzDce1RwlDcj4LaznZ.exe
"C:\Users\Admin\Documents\OzVvQBKzDce1RwlDcj4LaznZ.exe"
6⤵
PID:3276

C:\Users\Admin\Documents\i1fZ6aARi1_yZHezFzNWgIZv.exe
"C:\Users\Admin\Documents\i1fZ6aARi1_yZHezFzNWgIZv.exe"
6⤵
PID:3264

C:\Users\Admin\Documents\i1fZ6aARi1_yZHezFzNWgIZv.exe
C:\Users\Admin\Documents\i1fZ6aARi1_yZHezFzNWgIZv.exe
7⤵
PID:3008

C:\Users\Admin\Documents\7uksuKvg5Tcnzim9aJh7tZtv.exe
"C:\Users\Admin\Documents\7uksuKvg5Tcnzim9aJh7tZtv.exe"
6⤵
PID:3256

C:\Users\Admin\Documents\6BZHAFhYK1WdRh5n6KLloydZ.exe
"C:\Users\Admin\Documents\6BZHAFhYK1WdRh5n6KLloydZ.exe"
6⤵
PID:3248

C:\Users\Admin\Documents\APUMH6VrP6Q4dLwI4fU4Ng7m.exe
"C:\Users\Admin\Documents\APUMH6VrP6Q4dLwI4fU4Ng7m.exe"
6⤵
PID:3240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LCCcuso49k.bat"
7⤵
PID:2128

C:\Windows\system32\chcp.com
chcp 65001
8⤵
PID:4756

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:4932

C:\Users\Admin\Documents\KNJlIS2IgAVTu5ku4GV0YSlu\Yar_hoC8nVIq0sRSeG0wTnAQ.exe
"C:\Users\Admin\Documents\KNJlIS2IgAVTu5ku4GV0YSlu\Yar_hoC8nVIq0sRSeG0wTnAQ.exe"
8⤵
PID:3432

C:\Users\Admin\Documents\XTbdIdY6JnHMoRQFTT3scEtm.exe
"C:\Users\Admin\Documents\XTbdIdY6JnHMoRQFTT3scEtm.exe"
6⤵
PID:3232

C:\Users\Admin\Documents\_mBjvj2sxbK9Wx9Ui6q5OnhF.exe
"C:\Users\Admin\Documents\_mBjvj2sxbK9Wx9Ui6q5OnhF.exe"
6⤵
PID:3224

C:\Users\Admin\Documents\eVvyF7OpEidgcnlekXaJ2uVl.exe
"C:\Users\Admin\Documents\eVvyF7OpEidgcnlekXaJ2uVl.exe"
6⤵
PID:3216

C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe
"C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"
5⤵
PID:2584

C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe
"C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"
6⤵
PID:3980

C:\Users\Admin\Documents\u3fD2NvU7_kxzSSpyXhsRfMe.exe
"C:\Users\Admin\Documents\u3fD2NvU7_kxzSSpyXhsRfMe.exe"
2⤵
- Executes dropped EXE
PID:1308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "u3fD2NvU7_kxzSSpyXhsRfMe.exe" /f & erase "C:\Users\Admin\Documents\u3fD2NvU7_kxzSSpyXhsRfMe.exe" & exit
3⤵
PID:1280

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "u3fD2NvU7_kxzSSpyXhsRfMe.exe" /f
4⤵
- Kills process with taskkill
PID:632

C:\Users\Admin\Documents\O9sZLDywJ6cOKGZFfr0xbmea.exe
"C:\Users\Admin\Documents\O9sZLDywJ6cOKGZFfr0xbmea.exe"
2⤵
- Executes dropped EXE
PID:1740

C:\Users\Admin\Documents\O9sZLDywJ6cOKGZFfr0xbmea.exe
"C:\Users\Admin\Documents\O9sZLDywJ6cOKGZFfr0xbmea.exe"
3⤵
PID:2944

C:\Users\Admin\Documents\iYzNV8Mx6AO2LOfx_GsDaw_r.exe
"C:\Users\Admin\Documents\iYzNV8Mx6AO2LOfx_GsDaw_r.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1624

C:\Program Files (x86)\Company\NewProduct\customer3.exe
"C:\Program Files (x86)\Company\NewProduct\customer3.exe"
3⤵
PID:2468

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2600

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:2880

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:816

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:2880

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:1312

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:844

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2052

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:1956

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
3⤵
- Executes dropped EXE
PID:1784

C:\Program Files (x86)\Company\NewProduct\jooyu.exe
"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
3⤵
- Executes dropped EXE
PID:544

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:1648

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2376

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:4860

C:\Users\Admin\Documents\nBlxgyXpYbJcqvEg1Nx1B2dP.exe
"C:\Users\Admin\Documents\nBlxgyXpYbJcqvEg1Nx1B2dP.exe"
2⤵
- Executes dropped EXE
PID:1812

C:\Users\Admin\Documents\nBlxgyXpYbJcqvEg1Nx1B2dP.exe
"C:\Users\Admin\Documents\nBlxgyXpYbJcqvEg1Nx1B2dP.exe" -q
3⤵
- Executes dropped EXE
PID:2004

C:\Users\Admin\Documents\vbDvwp4PwMZfcqk2gfuywmRQ.exe
"C:\Users\Admin\Documents\vbDvwp4PwMZfcqk2gfuywmRQ.exe"
2⤵
- Executes dropped EXE
PID:644

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "vbDvwp4PwMZfcqk2gfuywmRQ.exe" /f & erase "C:\Users\Admin\Documents\vbDvwp4PwMZfcqk2gfuywmRQ.exe" & exit
3⤵
PID:2524

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "vbDvwp4PwMZfcqk2gfuywmRQ.exe" /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Users\Admin\Documents\nkv02qk9205_ar_KFbqrigdO.exe
"C:\Users\Admin\Documents\nkv02qk9205_ar_KFbqrigdO.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Users\Admin\Documents\KNJlIS2IgAVTu5ku4GV0YSlu.exe
"C:\Users\Admin\Documents\KNJlIS2IgAVTu5ku4GV0YSlu.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Users\Admin\Documents\KNJlIS2IgAVTu5ku4GV0YSlu.exe
"C:\Users\Admin\Documents\KNJlIS2IgAVTu5ku4GV0YSlu.exe"
3⤵
PID:1692

C:\Users\Admin\Documents\ToXiJv1gzSbjAWlriAPsn6sG.exe
"C:\Users\Admin\Documents\ToXiJv1gzSbjAWlriAPsn6sG.exe"
2⤵
- Executes dropped EXE
PID:736

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\TOXIJV~1.DLL,s C:\Users\Admin\DOCUME~1\TOXIJV~1.EXE
3⤵
PID:1088

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\TOXIJV~1.DLL,WTApOWI=
4⤵
PID:3196

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\TOXIJV~1.DLL,QjQNVE10MW9a
5⤵
PID:3692

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 29736
6⤵
PID:4184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp11CC.tmp.ps1"
5⤵
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "md8_8eus" /sc ONLOGON /tr "'C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\md8_8eus.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vs1mlBAD6CaBs9Kg_j31IA7A" /sc ONLOGON /tr "'C:\Users\Admin\Documents\DRQBAC9qpUOGsVu1doxrhNcC\vs1mlBAD6CaBs9Kg_j31IA7A.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\Apphlpdm\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2368

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2936

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2764

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2924

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2188

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3040

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1836

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2328

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Inlog" /sc ONLOGON /tr "'C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation\Inlog.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Stats" /sc ONLOGON /tr "'C:\ProgramData\Templates\Stats.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Yar_hoC8nVIq0sRSeG0wTnAQ" /sc ONLOGON /tr "'C:\Users\Admin\Documents\KNJlIS2IgAVTu5ku4GV0YSlu\Yar_hoC8nVIq0sRSeG0wTnAQ.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDSL1\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\api-ms-win-core-handle-l1-1-0\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "VPN.tmp" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\is-HPLV5.tmp\VPN.tmp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sQE5BDTauRI8cWYIkPXMcmVm" /sc ONLOGON /tr "'C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\sQE5BDTauRI8cWYIkPXMcmVm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Stats" /sc ONLOGON /tr "'C:\Recovery\4537d782-9a0d-11eb-a52e-c2ebb310cb62\Stats.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mshta" /sc ONLOGON /tr "'C:\Windows\SysWOW64\ds32gt\mshta.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XTbdIdY6JnHMoRQFTT3scEtm" /sc ONLOGON /tr "'C:\Users\Admin\Documents\i_IkKr1GPdHTBiwjOsF3Dsr3\XTbdIdY6JnHMoRQFTT3scEtm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3808

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DC8EA58591313CC7B9F371030E42475E C
2⤵
PID:3444

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A4A0172475DC43DEC786DB1CB65F76DC
2⤵
PID:4708

C:\Users\Admin\AppData\Local\Temp\A007.exe
C:\Users\Admin\AppData\Local\Temp\A007.exe
1⤵
PID:3976

C:\Windows\system32\taskeng.exe
taskeng.exe {5CEBC5A5-F0EE-4CC7-8364-493C226A522E} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
PID:1440

C:\Users\Admin\AppData\Roaming\uagbfcr
C:\Users\Admin\AppData\Roaming\uagbfcr
2⤵
PID:2976

C:\Users\Admin\AppData\Roaming\jbgbfcr
C:\Users\Admin\AppData\Roaming\jbgbfcr
2⤵
PID:3708

C:\Users\Admin\AppData\Roaming\jegbfcr
C:\Users\Admin\AppData\Roaming\jegbfcr
2⤵
PID:4064

C:\Users\Admin\AppData\Local\Temp\CED.exe
C:\Users\Admin\AppData\Local\Temp\CED.exe
1⤵
PID:1304

C:\Users\Admin\AppData\Local\Temp\FA49.exe
C:\Users\Admin\AppData\Local\Temp\FA49.exe
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 788
2⤵
- Program crash
PID:5088

C:\Users\Admin\AppData\Local\Temp\9E36.exe
C:\Users\Admin\AppData\Local\Temp\9E36.exe
1⤵
PID:2216

C:\Users\Admin\AppData\Local\Temp\9532.exe
C:\Users\Admin\AppData\Local\Temp\9532.exe
1⤵
PID:3176

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4308

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3652

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3584

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4940

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3384

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3556

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4464

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2052

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery