Overview
overview
10Static
static
Setup (1).exe
windows7_x64
Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
477s -
max time network
1851s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27/08/2021, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
Setup (23).exe
Resource
win10v20210410
General
-
Target
Setup (20).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
205.185.119.191:18846
Extracted
redline
27.08
95.181.172.100:55640
Extracted
redline
dibild2
135.148.139.222:1494
Extracted
redline
supertraff
135.148.139.222:1494
Extracted
redline
ads
45.93.4.12:80
Extracted
redline
installs8912
185.186.142.245:22850
Extracted
redline
TEST 22.08
94.103.83.88:65136
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2684 2572 rundll32.exe 66 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 20 IoCs
resource yara_rule behavioral25/memory/2016-178-0x0000000004570000-0x000000000458C000-memory.dmp family_redline behavioral25/memory/2016-180-0x0000000004670000-0x000000000468A000-memory.dmp family_redline behavioral25/memory/2740-181-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral25/memory/2748-183-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral25/memory/2756-184-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral25/memory/2740-187-0x000000000041C6B2-mapping.dmp family_redline behavioral25/memory/2756-188-0x000000000041A6B2-mapping.dmp family_redline behavioral25/memory/2740-189-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral25/memory/2748-190-0x000000000041A616-mapping.dmp family_redline behavioral25/memory/2756-191-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral25/memory/2748-197-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral25/memory/2820-198-0x000000000041C6B2-mapping.dmp family_redline behavioral25/memory/2948-203-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral25/memory/2852-202-0x000000000041A6B2-mapping.dmp family_redline behavioral25/memory/2948-205-0x000000000041A67A-mapping.dmp family_redline behavioral25/memory/3000-208-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral25/memory/3052-213-0x000000000041A6B2-mapping.dmp family_redline behavioral25/memory/2608-229-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral25/memory/2608-230-0x000000000041A61A-mapping.dmp family_redline behavioral25/memory/2608-232-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 37 IoCs
pid Process 1780 iJ8dn1o8j9MrclHAWhPyScML.exe 1132 HEvwy79U9e0uCQjeSiJPIdcH.exe 800 xlSKI4_Usn6GoEjH_ZZEj4vo.exe 1792 Ht19QsVxZ8gQT0FPcvq1CSy0.exe 976 w5jcw3AwmlG2yWKfIdye3Nst.exe 300 DWWwAagMH9xsJyv7lMagQyTi.exe 1608 KmfobvkUTebSIT9K0aCoUwtk.exe 1812 fmcatxdSQSRQBW3cvh83U4R4.exe 2020 _385ozYQnBElci8ble31iIBk.exe 804 j84uoOz5TbcGsMAz3e5M3soV.exe 1568 MMEFGIsP7r7vdxkSZ1dMmjtW.exe 1356 7WjDZeq30FDlSYtuIIUp1FUc.exe 772 R9mRJGOJX9_kGY_QFAEVAQgC.exe 588 ei0J7HND1vrqbR2mjHT8CLlz.exe 332 mOeOaGmogKQk1xHQJ6pnu7ex.exe 1500 mZTMRDXEaWx4wI4QN4cMnD4N.exe 1996 h5dRM3pAO4fwRsmzdC2WzXmy.exe 1836 kfTkFgV3NN8fatsNfDTA0yOU.exe 1800 uxnPH0t0O5dQltlmLzTUlccm.exe 524 SEDwwE61tMcfz706bePEM3fZ.exe 2016 IdJ9OCFA1yBuCxSBPReS4bUZ.exe 1320 xZSWKgEHcPbV8GDPnF4tXhWk.exe 1804 aFJajiwJ4WDdgGSXEDTagzyQ.exe 456 ZDKAqi3Uw6o9u4VishzJiUOp.exe 2064 A1E8ailYA6tPgPKdmzpoUOK4.exe 2740 7WjDZeq30FDlSYtuIIUp1FUc.exe 2756 aFJajiwJ4WDdgGSXEDTagzyQ.exe 2748 Ht19QsVxZ8gQT0FPcvq1CSy0.exe 2820 7WjDZeq30FDlSYtuIIUp1FUc.exe 2956 mOeOaGmogKQk1xHQJ6pnu7ex.exe 2852 aFJajiwJ4WDdgGSXEDTagzyQ.exe 3052 aFJajiwJ4WDdgGSXEDTagzyQ.exe 1600 lb6tRcWTC7YSnPTDO3le92Tw.exe 3028 HEvwy79U9e0uCQjeSiJPIdcH.exe 2888 mZTMRDXEaWx4wI4QN4cMnD4N.exe 2620 mZTMRDXEaWx4wI4QN4cMnD4N.exe 2640 mZTMRDXEaWx4wI4QN4cMnD4N.exe -
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion A1E8ailYA6tPgPKdmzpoUOK4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SEDwwE61tMcfz706bePEM3fZ.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SEDwwE61tMcfz706bePEM3fZ.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion A1E8ailYA6tPgPKdmzpoUOK4.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation Setup (20).exe -
Loads dropped DLL 47 IoCs
pid Process 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 1032 Setup (20).exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 300 DWWwAagMH9xsJyv7lMagQyTi.exe 332 mOeOaGmogKQk1xHQJ6pnu7ex.exe 332 mOeOaGmogKQk1xHQJ6pnu7ex.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral25/files/0x000300000001310c-73.dat themida behavioral25/files/0x000300000001310c-100.dat themida behavioral25/files/0x0003000000013179-134.dat themida behavioral25/files/0x0003000000013179-149.dat themida behavioral25/files/0x0003000000013182-142.dat themida behavioral25/memory/2064-176-0x0000000000350000-0x0000000000351000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA A1E8ailYA6tPgPKdmzpoUOK4.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SEDwwE61tMcfz706bePEM3fZ.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 ipinfo.io 23 ipinfo.io 235 geoiptool.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2064 A1E8ailYA6tPgPKdmzpoUOK4.exe 524 SEDwwE61tMcfz706bePEM3fZ.exe -
Suspicious use of SetThreadContext 12 IoCs
description pid Process procid_target PID 1356 set thread context of 2740 1356 7WjDZeq30FDlSYtuIIUp1FUc.exe 70 PID 1792 set thread context of 2748 1792 Ht19QsVxZ8gQT0FPcvq1CSy0.exe 69 PID 1804 set thread context of 2756 1804 aFJajiwJ4WDdgGSXEDTagzyQ.exe 71 PID 1356 set thread context of 2820 1356 7WjDZeq30FDlSYtuIIUp1FUc.exe 72 PID 1804 set thread context of 2852 1804 aFJajiwJ4WDdgGSXEDTagzyQ.exe 73 PID 1792 set thread context of 2900 1792 Ht19QsVxZ8gQT0FPcvq1CSy0.exe 74 PID 300 set thread context of 2948 300 DWWwAagMH9xsJyv7lMagQyTi.exe 75 PID 1356 set thread context of 2992 1356 7WjDZeq30FDlSYtuIIUp1FUc.exe 79 PID 332 set thread context of 3000 332 mOeOaGmogKQk1xHQJ6pnu7ex.exe 78 PID 1132 set thread context of 3028 1132 HEvwy79U9e0uCQjeSiJPIdcH.exe 77 PID 1804 set thread context of 3052 1804 aFJajiwJ4WDdgGSXEDTagzyQ.exe 80 PID 1804 set thread context of 960 1804 aFJajiwJ4WDdgGSXEDTagzyQ.exe 81 -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 1808 2020 WerFault.exe 44 1680 1320 WerFault.exe 58 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI HEvwy79U9e0uCQjeSiJPIdcH.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI HEvwy79U9e0uCQjeSiJPIdcH.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI HEvwy79U9e0uCQjeSiJPIdcH.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2672 timeout.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2692 vssadmin.exe 3412 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 1644 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Setup (20).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (20).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Setup (20).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 xZSWKgEHcPbV8GDPnF4tXhWk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e xZSWKgEHcPbV8GDPnF4tXhWk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e xZSWKgEHcPbV8GDPnF4tXhWk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Setup (20).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (20).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e xZSWKgEHcPbV8GDPnF4tXhWk.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 134 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1032 Setup (20).exe 332 mOeOaGmogKQk1xHQJ6pnu7ex.exe 332 mOeOaGmogKQk1xHQJ6pnu7ex.exe 3028 HEvwy79U9e0uCQjeSiJPIdcH.exe 3028 HEvwy79U9e0uCQjeSiJPIdcH.exe 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3028 HEvwy79U9e0uCQjeSiJPIdcH.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 332 mOeOaGmogKQk1xHQJ6pnu7ex.exe Token: SeDebugPrivilege 2016 IdJ9OCFA1yBuCxSBPReS4bUZ.exe Token: SeDebugPrivilege 1644 taskkill.exe Token: SeDebugPrivilege 1500 mZTMRDXEaWx4wI4QN4cMnD4N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1132 1032 Setup (20).exe 32 PID 1032 wrote to memory of 1132 1032 Setup (20).exe 32 PID 1032 wrote to memory of 1132 1032 Setup (20).exe 32 PID 1032 wrote to memory of 1132 1032 Setup (20).exe 32 PID 1032 wrote to memory of 1792 1032 Setup (20).exe 36 PID 1032 wrote to memory of 1792 1032 Setup (20).exe 36 PID 1032 wrote to memory of 1792 1032 Setup (20).exe 36 PID 1032 wrote to memory of 1792 1032 Setup (20).exe 36 PID 1032 wrote to memory of 800 1032 Setup (20).exe 35 PID 1032 wrote to memory of 800 1032 Setup (20).exe 35 PID 1032 wrote to memory of 800 1032 Setup (20).exe 35 PID 1032 wrote to memory of 800 1032 Setup (20).exe 35 PID 1032 wrote to memory of 976 1032 Setup (20).exe 34 PID 1032 wrote to memory of 976 1032 Setup (20).exe 34 PID 1032 wrote to memory of 976 1032 Setup (20).exe 34 PID 1032 wrote to memory of 976 1032 Setup (20).exe 34 PID 1032 wrote to memory of 976 1032 Setup (20).exe 34 PID 1032 wrote to memory of 976 1032 Setup (20).exe 34 PID 1032 wrote to memory of 976 1032 Setup (20).exe 34 PID 1032 wrote to memory of 300 1032 Setup (20).exe 33 PID 1032 wrote to memory of 300 1032 Setup (20).exe 33 PID 1032 wrote to memory of 300 1032 Setup (20).exe 33 PID 1032 wrote to memory of 300 1032 Setup (20).exe 33 PID 1032 wrote to memory of 300 1032 Setup (20).exe 33 PID 1032 wrote to memory of 300 1032 Setup (20).exe 33 PID 1032 wrote to memory of 300 1032 Setup (20).exe 33 PID 1032 wrote to memory of 1608 1032 Setup (20).exe 46 PID 1032 wrote to memory of 1608 1032 Setup (20).exe 46 PID 1032 wrote to memory of 1608 1032 Setup (20).exe 46 PID 1032 wrote to memory of 1608 1032 Setup (20).exe 46 PID 1032 wrote to memory of 1812 1032 Setup (20).exe 45 PID 1032 wrote to memory of 1812 1032 Setup (20).exe 45 PID 1032 wrote to memory of 1812 1032 Setup (20).exe 45 PID 1032 wrote to memory of 1812 1032 Setup (20).exe 45 PID 1032 wrote to memory of 2020 1032 Setup (20).exe 44 PID 1032 wrote to memory of 2020 1032 Setup (20).exe 44 PID 1032 wrote to memory of 2020 1032 Setup (20).exe 44 PID 1032 wrote to memory of 2020 1032 Setup (20).exe 44 PID 1032 wrote to memory of 1568 1032 Setup (20).exe 43 PID 1032 wrote to memory of 1568 1032 Setup (20).exe 43 PID 1032 wrote to memory of 1568 1032 Setup (20).exe 43 PID 1032 wrote to memory of 1568 1032 Setup (20).exe 43 PID 1032 wrote to memory of 1356 1032 Setup (20).exe 42 PID 1032 wrote to memory of 1356 1032 Setup (20).exe 42 PID 1032 wrote to memory of 1356 1032 Setup (20).exe 42 PID 1032 wrote to memory of 1356 1032 Setup (20).exe 42 PID 1032 wrote to memory of 1232 1032 Setup (20).exe 41 PID 1032 wrote to memory of 1232 1032 Setup (20).exe 41 PID 1032 wrote to memory of 1232 1032 Setup (20).exe 41 PID 1032 wrote to memory of 1232 1032 Setup (20).exe 41 PID 1032 wrote to memory of 804 1032 Setup (20).exe 39 PID 1032 wrote to memory of 804 1032 Setup (20).exe 39 PID 1032 wrote to memory of 804 1032 Setup (20).exe 39 PID 1032 wrote to memory of 804 1032 Setup (20).exe 39 PID 1032 wrote to memory of 772 1032 Setup (20).exe 40 PID 1032 wrote to memory of 772 1032 Setup (20).exe 40 PID 1032 wrote to memory of 772 1032 Setup (20).exe 40 PID 1032 wrote to memory of 772 1032 Setup (20).exe 40 PID 1032 wrote to memory of 332 1032 Setup (20).exe 38 PID 1032 wrote to memory of 332 1032 Setup (20).exe 38 PID 1032 wrote to memory of 332 1032 Setup (20).exe 38 PID 1032 wrote to memory of 332 1032 Setup (20).exe 38 PID 1032 wrote to memory of 332 1032 Setup (20).exe 38 PID 1032 wrote to memory of 332 1032 Setup (20).exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (20).exe"C:\Users\Admin\AppData\Local\Temp\Setup (20).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\Documents\iJ8dn1o8j9MrclHAWhPyScML.exe"C:\Users\Admin\Documents\iJ8dn1o8j9MrclHAWhPyScML.exe"2⤵
- Executes dropped EXE
PID:1780
-
-
C:\Users\Admin\Documents\HEvwy79U9e0uCQjeSiJPIdcH.exe"C:\Users\Admin\Documents\HEvwy79U9e0uCQjeSiJPIdcH.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1132 -
C:\Users\Admin\Documents\HEvwy79U9e0uCQjeSiJPIdcH.exe"C:\Users\Admin\Documents\HEvwy79U9e0uCQjeSiJPIdcH.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3028
-
-
-
C:\Users\Admin\Documents\DWWwAagMH9xsJyv7lMagQyTi.exe"C:\Users\Admin\Documents\DWWwAagMH9xsJyv7lMagQyTi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:300 -
C:\Users\Admin\Documents\DWWwAagMH9xsJyv7lMagQyTi.exe"C:\Users\Admin\Documents\DWWwAagMH9xsJyv7lMagQyTi.exe"3⤵PID:2948
-
-
-
C:\Users\Admin\Documents\w5jcw3AwmlG2yWKfIdye3Nst.exe"C:\Users\Admin\Documents\w5jcw3AwmlG2yWKfIdye3Nst.exe"2⤵
- Executes dropped EXE
PID:976
-
-
C:\Users\Admin\Documents\xlSKI4_Usn6GoEjH_ZZEj4vo.exe"C:\Users\Admin\Documents\xlSKI4_Usn6GoEjH_ZZEj4vo.exe"2⤵
- Executes dropped EXE
PID:800
-
-
C:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exe"C:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1792 -
C:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exeC:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exe3⤵
- Executes dropped EXE
PID:2748
-
-
C:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exeC:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exe3⤵PID:2900
-
-
-
C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe"C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:332 -
C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe"C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe"3⤵
- Executes dropped EXE
PID:2956
-
-
C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe"C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe"3⤵PID:3000
-
-
-
C:\Users\Admin\Documents\j84uoOz5TbcGsMAz3e5M3soV.exe"C:\Users\Admin\Documents\j84uoOz5TbcGsMAz3e5M3soV.exe"2⤵
- Executes dropped EXE
PID:804
-
-
C:\Users\Admin\Documents\R9mRJGOJX9_kGY_QFAEVAQgC.exe"C:\Users\Admin\Documents\R9mRJGOJX9_kGY_QFAEVAQgC.exe"2⤵
- Executes dropped EXE
PID:772
-
-
C:\Users\Admin\Documents\tuaXWfYmjkDvLtEgT_tBlvRF.exe"C:\Users\Admin\Documents\tuaXWfYmjkDvLtEgT_tBlvRF.exe"2⤵PID:1232
-
-
C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe"C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1356 -
C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exeC:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe3⤵
- Executes dropped EXE
PID:2740
-
-
C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exeC:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe3⤵
- Executes dropped EXE
PID:2820
-
-
C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exeC:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe3⤵PID:2992
-
-
-
C:\Users\Admin\Documents\MMEFGIsP7r7vdxkSZ1dMmjtW.exe"C:\Users\Admin\Documents\MMEFGIsP7r7vdxkSZ1dMmjtW.exe"2⤵
- Executes dropped EXE
PID:1568
-
-
C:\Users\Admin\Documents\_385ozYQnBElci8ble31iIBk.exe"C:\Users\Admin\Documents\_385ozYQnBElci8ble31iIBk.exe"2⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 8763⤵
- Loads dropped DLL
- Program crash
PID:1808
-
-
-
C:\Users\Admin\Documents\fmcatxdSQSRQBW3cvh83U4R4.exe"C:\Users\Admin\Documents\fmcatxdSQSRQBW3cvh83U4R4.exe"2⤵
- Executes dropped EXE
PID:1812
-
-
C:\Users\Admin\Documents\KmfobvkUTebSIT9K0aCoUwtk.exe"C:\Users\Admin\Documents\KmfobvkUTebSIT9K0aCoUwtk.exe"2⤵
- Executes dropped EXE
PID:1608
-
-
C:\Users\Admin\Documents\ei0J7HND1vrqbR2mjHT8CLlz.exe"C:\Users\Admin\Documents\ei0J7HND1vrqbR2mjHT8CLlz.exe"2⤵
- Executes dropped EXE
PID:588 -
C:\Users\Admin\Documents\ei0J7HND1vrqbR2mjHT8CLlz.exe"C:\Users\Admin\Documents\ei0J7HND1vrqbR2mjHT8CLlz.exe"3⤵PID:3756
-
-
-
C:\Users\Admin\Documents\A1E8ailYA6tPgPKdmzpoUOK4.exe"C:\Users\Admin\Documents\A1E8ailYA6tPgPKdmzpoUOK4.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2064
-
-
C:\Users\Admin\Documents\uxnPH0t0O5dQltlmLzTUlccm.exe"C:\Users\Admin\Documents\uxnPH0t0O5dQltlmLzTUlccm.exe"2⤵
- Executes dropped EXE
PID:1800
-
-
C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe"C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1804 -
C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exeC:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe3⤵
- Executes dropped EXE
PID:2756
-
-
C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exeC:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe3⤵
- Executes dropped EXE
PID:2852
-
-
C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exeC:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe3⤵
- Executes dropped EXE
PID:3052
-
-
C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exeC:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe3⤵PID:960
-
-
-
C:\Users\Admin\Documents\SEDwwE61tMcfz706bePEM3fZ.exe"C:\Users\Admin\Documents\SEDwwE61tMcfz706bePEM3fZ.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:524
-
-
C:\Users\Admin\Documents\ZDKAqi3Uw6o9u4VishzJiUOp.exe"C:\Users\Admin\Documents\ZDKAqi3Uw6o9u4VishzJiUOp.exe"2⤵
- Executes dropped EXE
PID:456
-
-
C:\Users\Admin\Documents\h5dRM3pAO4fwRsmzdC2WzXmy.exe"C:\Users\Admin\Documents\h5dRM3pAO4fwRsmzdC2WzXmy.exe"2⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "h5dRM3pAO4fwRsmzdC2WzXmy.exe" /f & erase "C:\Users\Admin\Documents\h5dRM3pAO4fwRsmzdC2WzXmy.exe" & exit3⤵PID:1268
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "h5dRM3pAO4fwRsmzdC2WzXmy.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
-
-
C:\Users\Admin\Documents\IdJ9OCFA1yBuCxSBPReS4bUZ.exe"C:\Users\Admin\Documents\IdJ9OCFA1yBuCxSBPReS4bUZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Users\Admin\Documents\lb6tRcWTC7YSnPTDO3le92Tw.exe"C:\Users\Admin\Documents\lb6tRcWTC7YSnPTDO3le92Tw.exe"2⤵
- Executes dropped EXE
PID:1600
-
-
C:\Users\Admin\Documents\xZSWKgEHcPbV8GDPnF4tXhWk.exe"C:\Users\Admin\Documents\xZSWKgEHcPbV8GDPnF4tXhWk.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 8483⤵
- Program crash
PID:1680
-
-
-
C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"3⤵
- Executes dropped EXE
PID:2888
-
-
C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"3⤵
- Executes dropped EXE
PID:2620
-
-
C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"3⤵PID:2608
-
-
C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"3⤵
- Executes dropped EXE
PID:2640
-
-
-
C:\Users\Admin\Documents\kfTkFgV3NN8fatsNfDTA0yOU.exe"C:\Users\Admin\Documents\kfTkFgV3NN8fatsNfDTA0yOU.exe"2⤵
- Executes dropped EXE
PID:1836
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\4F1A.exeC:\Users\Admin\AppData\Local\Temp\4F1A.exe1⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\9F2E.exeC:\Users\Admin\AppData\Local\Temp\9F2E.exe1⤵PID:2940
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\chhdfxka\2⤵PID:2444
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jmkfzgqa.exe" C:\Windows\SysWOW64\chhdfxka\2⤵PID:2816
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create chhdfxka binPath= "C:\Windows\SysWOW64\chhdfxka\jmkfzgqa.exe /d\"C:\Users\Admin\AppData\Local\Temp\9F2E.exe\"" type= own start= auto DisplayName= "wifi support"2⤵PID:2516
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description chhdfxka "wifi internet conection"2⤵PID:2448
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start chhdfxka2⤵PID:952
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵PID:1244
-
-
C:\Users\Admin\frdllwlt.exe"C:\Users\Admin\frdllwlt.exe" /d"C:\Users\Admin\AppData\Local\Temp\9F2E.exe"2⤵PID:3040
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bvrxiskq.exe" C:\Windows\SysWOW64\chhdfxka\3⤵PID:2708
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" config chhdfxka binPath= "C:\Windows\SysWOW64\chhdfxka\bvrxiskq.exe /d\"C:\Users\Admin\frdllwlt.exe\""3⤵PID:2136
-
-
-
C:\Users\Admin\AppData\Local\Temp\9AAB.exeC:\Users\Admin\AppData\Local\Temp\9AAB.exe1⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\15D5.exeC:\Users\Admin\AppData\Local\Temp\15D5.exe1⤵PID:1620
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -start2⤵PID:2632
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵PID:2796
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -agent 03⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat3⤵PID:2844
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵PID:2944
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:3412
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet3⤵PID:2016
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2692
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet3⤵PID:2616
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no3⤵PID:2972
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete3⤵PID:2592
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵PID:396
-
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵PID:968
-
-
C:\Users\Admin\AppData\Local\Temp\4435.exeC:\Users\Admin\AppData\Local\Temp\4435.exe1⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\4435.exeC:\Users\Admin\AppData\Local\Temp\4435.exe2⤵PID:2384
-
-
C:\Users\Admin\AppData\Local\Temp\72A6.exeC:\Users\Admin\AppData\Local\Temp\72A6.exe1⤵PID:2420
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"2⤵PID:2244
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"2⤵PID:1780
-
-
C:\Users\Admin\AppData\Local\Temp\DA5E.exeC:\Users\Admin\AppData\Local\Temp\DA5E.exe1⤵PID:1040
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\DA5E.exe" & exit2⤵PID:2072
-
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:2672
-
-
-
C:\Users\Admin\AppData\Local\Temp\E01A.exeC:\Users\Admin\AppData\Local\Temp\E01A.exe1⤵PID:2976
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2304
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2388
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2776
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2720
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2320
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2096
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2496
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2308
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2124
-
C:\Windows\system32\taskeng.exetaskeng.exe {49E6C92C-6595-40D1-A33B-CF968F4DF567} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵PID:2884
-
C:\Users\Admin\AppData\Roaming\cihhreeC:\Users\Admin\AppData\Roaming\cihhree2⤵PID:1756
-
C:\Users\Admin\AppData\Roaming\cihhreeC:\Users\Admin\AppData\Roaming\cihhree3⤵PID:1628
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3092
-
C:\Windows\system32\taskeng.exetaskeng.exe {093FB08C-B944-4218-B630-9F1358DE4F42} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵PID:3540
-
C:\Users\Admin\AppData\Roaming\cihhreeC:\Users\Admin\AppData\Roaming\cihhree2⤵PID:3668
-
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Disabling Security Tools
1File Deletion
2Install Root Certificate
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1