Resubmissions

15/10/2024, 15:36

241015-s1zlzasdkc 10

01/07/2024, 18:32

240701-w6yteawhmq 10

01/07/2024, 14:52

240701-r82wmaxdnd 10

01/07/2024, 14:52

240701-r8syqa1dpp 10

11/03/2024, 21:22

240311-z8dsssgg58 10

01/09/2021, 13:18

210901-5bmxjspa5s 10

01/09/2021, 13:04

210901-te4btfspqa 10

01/09/2021, 05:12

210901-4wnkwm1p3j 10

31/08/2021, 21:47

210831-41rp97dma2 10

Analysis

  • max time kernel
    477s
  • max time network
    1851s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    27/08/2021, 15:40

General

  • Target

    Setup (20).exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Malware Config

Extracted

Family

redline

C2

205.185.119.191:18846

Extracted

Family

redline

Botnet

27.08

C2

95.181.172.100:55640

Extracted

Family

redline

Botnet

dibild2

C2

135.148.139.222:1494

Extracted

Family

redline

Botnet

supertraff

C2

135.148.139.222:1494

Extracted

Family

redline

Botnet

ads

C2

45.93.4.12:80

Extracted

Family

redline

Botnet

installs8912

C2

185.186.142.245:22850

Extracted

Family

redline

Botnet

TEST 22.08

C2

94.103.83.88:65136

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 20 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 37 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 47 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 12 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup (20).exe
    "C:\Users\Admin\AppData\Local\Temp\Setup (20).exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Users\Admin\Documents\iJ8dn1o8j9MrclHAWhPyScML.exe
      "C:\Users\Admin\Documents\iJ8dn1o8j9MrclHAWhPyScML.exe"
      2⤵
      • Executes dropped EXE
      PID:1780
    • C:\Users\Admin\Documents\HEvwy79U9e0uCQjeSiJPIdcH.exe
      "C:\Users\Admin\Documents\HEvwy79U9e0uCQjeSiJPIdcH.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1132
      • C:\Users\Admin\Documents\HEvwy79U9e0uCQjeSiJPIdcH.exe
        "C:\Users\Admin\Documents\HEvwy79U9e0uCQjeSiJPIdcH.exe"
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:3028
    • C:\Users\Admin\Documents\DWWwAagMH9xsJyv7lMagQyTi.exe
      "C:\Users\Admin\Documents\DWWwAagMH9xsJyv7lMagQyTi.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      PID:300
      • C:\Users\Admin\Documents\DWWwAagMH9xsJyv7lMagQyTi.exe
        "C:\Users\Admin\Documents\DWWwAagMH9xsJyv7lMagQyTi.exe"
        3⤵
          PID:2948
      • C:\Users\Admin\Documents\w5jcw3AwmlG2yWKfIdye3Nst.exe
        "C:\Users\Admin\Documents\w5jcw3AwmlG2yWKfIdye3Nst.exe"
        2⤵
        • Executes dropped EXE
        PID:976
      • C:\Users\Admin\Documents\xlSKI4_Usn6GoEjH_ZZEj4vo.exe
        "C:\Users\Admin\Documents\xlSKI4_Usn6GoEjH_ZZEj4vo.exe"
        2⤵
        • Executes dropped EXE
        PID:800
      • C:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exe
        "C:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:1792
        • C:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exe
          C:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exe
          3⤵
          • Executes dropped EXE
          PID:2748
        • C:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exe
          C:\Users\Admin\Documents\Ht19QsVxZ8gQT0FPcvq1CSy0.exe
          3⤵
            PID:2900
        • C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe
          "C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:332
          • C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe
            "C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe"
            3⤵
            • Executes dropped EXE
            PID:2956
          • C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe
            "C:\Users\Admin\Documents\mOeOaGmogKQk1xHQJ6pnu7ex.exe"
            3⤵
              PID:3000
          • C:\Users\Admin\Documents\j84uoOz5TbcGsMAz3e5M3soV.exe
            "C:\Users\Admin\Documents\j84uoOz5TbcGsMAz3e5M3soV.exe"
            2⤵
            • Executes dropped EXE
            PID:804
          • C:\Users\Admin\Documents\R9mRJGOJX9_kGY_QFAEVAQgC.exe
            "C:\Users\Admin\Documents\R9mRJGOJX9_kGY_QFAEVAQgC.exe"
            2⤵
            • Executes dropped EXE
            PID:772
          • C:\Users\Admin\Documents\tuaXWfYmjkDvLtEgT_tBlvRF.exe
            "C:\Users\Admin\Documents\tuaXWfYmjkDvLtEgT_tBlvRF.exe"
            2⤵
              PID:1232
            • C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe
              "C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1356
              • C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe
                C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe
                3⤵
                • Executes dropped EXE
                PID:2740
              • C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe
                C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe
                3⤵
                • Executes dropped EXE
                PID:2820
              • C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe
                C:\Users\Admin\Documents\7WjDZeq30FDlSYtuIIUp1FUc.exe
                3⤵
                  PID:2992
              • C:\Users\Admin\Documents\MMEFGIsP7r7vdxkSZ1dMmjtW.exe
                "C:\Users\Admin\Documents\MMEFGIsP7r7vdxkSZ1dMmjtW.exe"
                2⤵
                • Executes dropped EXE
                PID:1568
              • C:\Users\Admin\Documents\_385ozYQnBElci8ble31iIBk.exe
                "C:\Users\Admin\Documents\_385ozYQnBElci8ble31iIBk.exe"
                2⤵
                • Executes dropped EXE
                PID:2020
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 876
                  3⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:1808
              • C:\Users\Admin\Documents\fmcatxdSQSRQBW3cvh83U4R4.exe
                "C:\Users\Admin\Documents\fmcatxdSQSRQBW3cvh83U4R4.exe"
                2⤵
                • Executes dropped EXE
                PID:1812
              • C:\Users\Admin\Documents\KmfobvkUTebSIT9K0aCoUwtk.exe
                "C:\Users\Admin\Documents\KmfobvkUTebSIT9K0aCoUwtk.exe"
                2⤵
                • Executes dropped EXE
                PID:1608
              • C:\Users\Admin\Documents\ei0J7HND1vrqbR2mjHT8CLlz.exe
                "C:\Users\Admin\Documents\ei0J7HND1vrqbR2mjHT8CLlz.exe"
                2⤵
                • Executes dropped EXE
                PID:588
                • C:\Users\Admin\Documents\ei0J7HND1vrqbR2mjHT8CLlz.exe
                  "C:\Users\Admin\Documents\ei0J7HND1vrqbR2mjHT8CLlz.exe"
                  3⤵
                    PID:3756
                • C:\Users\Admin\Documents\A1E8ailYA6tPgPKdmzpoUOK4.exe
                  "C:\Users\Admin\Documents\A1E8ailYA6tPgPKdmzpoUOK4.exe"
                  2⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Checks whether UAC is enabled
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:2064
                • C:\Users\Admin\Documents\uxnPH0t0O5dQltlmLzTUlccm.exe
                  "C:\Users\Admin\Documents\uxnPH0t0O5dQltlmLzTUlccm.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:1800
                • C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe
                  "C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:1804
                  • C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe
                    C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe
                    3⤵
                    • Executes dropped EXE
                    PID:2756
                  • C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe
                    C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe
                    3⤵
                    • Executes dropped EXE
                    PID:2852
                  • C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe
                    C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe
                    3⤵
                    • Executes dropped EXE
                    PID:3052
                  • C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe
                    C:\Users\Admin\Documents\aFJajiwJ4WDdgGSXEDTagzyQ.exe
                    3⤵
                      PID:960
                  • C:\Users\Admin\Documents\SEDwwE61tMcfz706bePEM3fZ.exe
                    "C:\Users\Admin\Documents\SEDwwE61tMcfz706bePEM3fZ.exe"
                    2⤵
                    • Executes dropped EXE
                    • Checks BIOS information in registry
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:524
                  • C:\Users\Admin\Documents\ZDKAqi3Uw6o9u4VishzJiUOp.exe
                    "C:\Users\Admin\Documents\ZDKAqi3Uw6o9u4VishzJiUOp.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:456
                  • C:\Users\Admin\Documents\h5dRM3pAO4fwRsmzdC2WzXmy.exe
                    "C:\Users\Admin\Documents\h5dRM3pAO4fwRsmzdC2WzXmy.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:1996
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c taskkill /im "h5dRM3pAO4fwRsmzdC2WzXmy.exe" /f & erase "C:\Users\Admin\Documents\h5dRM3pAO4fwRsmzdC2WzXmy.exe" & exit
                      3⤵
                        PID:1268
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /im "h5dRM3pAO4fwRsmzdC2WzXmy.exe" /f
                          4⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1644
                    • C:\Users\Admin\Documents\IdJ9OCFA1yBuCxSBPReS4bUZ.exe
                      "C:\Users\Admin\Documents\IdJ9OCFA1yBuCxSBPReS4bUZ.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2016
                    • C:\Users\Admin\Documents\lb6tRcWTC7YSnPTDO3le92Tw.exe
                      "C:\Users\Admin\Documents\lb6tRcWTC7YSnPTDO3le92Tw.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:1600
                    • C:\Users\Admin\Documents\xZSWKgEHcPbV8GDPnF4tXhWk.exe
                      "C:\Users\Admin\Documents\xZSWKgEHcPbV8GDPnF4tXhWk.exe"
                      2⤵
                      • Executes dropped EXE
                      • Modifies system certificate store
                      PID:1320
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 848
                        3⤵
                        • Program crash
                        PID:1680
                    • C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe
                      "C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1500
                      • C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe
                        "C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:2888
                      • C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe
                        "C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:2620
                      • C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe
                        "C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"
                        3⤵
                          PID:2608
                        • C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe
                          "C:\Users\Admin\Documents\mZTMRDXEaWx4wI4QN4cMnD4N.exe"
                          3⤵
                          • Executes dropped EXE
                          PID:2640
                      • C:\Users\Admin\Documents\kfTkFgV3NN8fatsNfDTA0yOU.exe
                        "C:\Users\Admin\Documents\kfTkFgV3NN8fatsNfDTA0yOU.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:1836
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                      1⤵
                      • Process spawned unexpected child process
                      PID:2684
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                        2⤵
                        • Loads dropped DLL
                        PID:2704
                    • C:\Users\Admin\AppData\Local\Temp\4F1A.exe
                      C:\Users\Admin\AppData\Local\Temp\4F1A.exe
                      1⤵
                        PID:1656
                      • C:\Users\Admin\AppData\Local\Temp\9F2E.exe
                        C:\Users\Admin\AppData\Local\Temp\9F2E.exe
                        1⤵
                          PID:2940
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\chhdfxka\
                            2⤵
                              PID:2444
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jmkfzgqa.exe" C:\Windows\SysWOW64\chhdfxka\
                              2⤵
                                PID:2816
                              • C:\Windows\SysWOW64\sc.exe
                                "C:\Windows\System32\sc.exe" create chhdfxka binPath= "C:\Windows\SysWOW64\chhdfxka\jmkfzgqa.exe /d\"C:\Users\Admin\AppData\Local\Temp\9F2E.exe\"" type= own start= auto DisplayName= "wifi support"
                                2⤵
                                  PID:2516
                                • C:\Windows\SysWOW64\sc.exe
                                  "C:\Windows\System32\sc.exe" description chhdfxka "wifi internet conection"
                                  2⤵
                                    PID:2448
                                  • C:\Windows\SysWOW64\sc.exe
                                    "C:\Windows\System32\sc.exe" start chhdfxka
                                    2⤵
                                      PID:952
                                    • C:\Windows\SysWOW64\netsh.exe
                                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                      2⤵
                                        PID:1244
                                      • C:\Users\Admin\frdllwlt.exe
                                        "C:\Users\Admin\frdllwlt.exe" /d"C:\Users\Admin\AppData\Local\Temp\9F2E.exe"
                                        2⤵
                                          PID:3040
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bvrxiskq.exe" C:\Windows\SysWOW64\chhdfxka\
                                            3⤵
                                              PID:2708
                                            • C:\Windows\SysWOW64\sc.exe
                                              "C:\Windows\System32\sc.exe" config chhdfxka binPath= "C:\Windows\SysWOW64\chhdfxka\bvrxiskq.exe /d\"C:\Users\Admin\frdllwlt.exe\""
                                              3⤵
                                                PID:2136
                                          • C:\Users\Admin\AppData\Local\Temp\9AAB.exe
                                            C:\Users\Admin\AppData\Local\Temp\9AAB.exe
                                            1⤵
                                              PID:2012
                                            • C:\Users\Admin\AppData\Local\Temp\15D5.exe
                                              C:\Users\Admin\AppData\Local\Temp\15D5.exe
                                              1⤵
                                                PID:1620
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -start
                                                  2⤵
                                                    PID:2632
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                      3⤵
                                                        PID:2796
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -agent 0
                                                        3⤵
                                                          PID:1408
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                                                          3⤵
                                                            PID:2844
                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                              wmic shadowcopy delete
                                                              4⤵
                                                                PID:2944
                                                              • C:\Windows\SysWOW64\vssadmin.exe
                                                                vssadmin delete shadows /all /quiet
                                                                4⤵
                                                                • Interacts with shadow copies
                                                                PID:3412
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                                                              3⤵
                                                                PID:2016
                                                                • C:\Windows\SysWOW64\vssadmin.exe
                                                                  vssadmin delete shadows /all /quiet
                                                                  4⤵
                                                                  • Interacts with shadow copies
                                                                  PID:2692
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                                                                3⤵
                                                                  PID:2616
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                                                                  3⤵
                                                                    PID:2972
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                                                                    3⤵
                                                                      PID:2592
                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                        wmic shadowcopy delete
                                                                        4⤵
                                                                          PID:396
                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                      notepad.exe
                                                                      2⤵
                                                                        PID:968
                                                                    • C:\Users\Admin\AppData\Local\Temp\4435.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\4435.exe
                                                                      1⤵
                                                                        PID:2984
                                                                        • C:\Users\Admin\AppData\Local\Temp\4435.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\4435.exe
                                                                          2⤵
                                                                            PID:2384
                                                                        • C:\Users\Admin\AppData\Local\Temp\72A6.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\72A6.exe
                                                                          1⤵
                                                                            PID:2420
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                              "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"
                                                                              2⤵
                                                                                PID:2244
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"
                                                                                2⤵
                                                                                  PID:1780
                                                                              • C:\Users\Admin\AppData\Local\Temp\DA5E.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\DA5E.exe
                                                                                1⤵
                                                                                  PID:1040
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\DA5E.exe" & exit
                                                                                    2⤵
                                                                                      PID:2072
                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                        timeout /t 5
                                                                                        3⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:2672
                                                                                  • C:\Users\Admin\AppData\Local\Temp\E01A.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\E01A.exe
                                                                                    1⤵
                                                                                      PID:2976
                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                      1⤵
                                                                                        PID:2304
                                                                                      • C:\Windows\explorer.exe
                                                                                        C:\Windows\explorer.exe
                                                                                        1⤵
                                                                                          PID:2388
                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                          1⤵
                                                                                            PID:2776
                                                                                          • C:\Windows\explorer.exe
                                                                                            C:\Windows\explorer.exe
                                                                                            1⤵
                                                                                              PID:2720
                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                              C:\Windows\SysWOW64\explorer.exe
                                                                                              1⤵
                                                                                                PID:2320
                                                                                              • C:\Windows\explorer.exe
                                                                                                C:\Windows\explorer.exe
                                                                                                1⤵
                                                                                                  PID:2096
                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                  1⤵
                                                                                                    PID:2496
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    C:\Windows\explorer.exe
                                                                                                    1⤵
                                                                                                      PID:2308
                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                      1⤵
                                                                                                        PID:2124
                                                                                                      • C:\Windows\system32\taskeng.exe
                                                                                                        taskeng.exe {49E6C92C-6595-40D1-A33B-CF968F4DF567} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
                                                                                                        1⤵
                                                                                                          PID:2884
                                                                                                          • C:\Users\Admin\AppData\Roaming\cihhree
                                                                                                            C:\Users\Admin\AppData\Roaming\cihhree
                                                                                                            2⤵
                                                                                                              PID:1756
                                                                                                              • C:\Users\Admin\AppData\Roaming\cihhree
                                                                                                                C:\Users\Admin\AppData\Roaming\cihhree
                                                                                                                3⤵
                                                                                                                  PID:1628
                                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                                              C:\Windows\system32\vssvc.exe
                                                                                                              1⤵
                                                                                                                PID:3092
                                                                                                              • C:\Windows\system32\taskeng.exe
                                                                                                                taskeng.exe {093FB08C-B944-4218-B630-9F1358DE4F42} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
                                                                                                                1⤵
                                                                                                                  PID:3540
                                                                                                                  • C:\Users\Admin\AppData\Roaming\cihhree
                                                                                                                    C:\Users\Admin\AppData\Roaming\cihhree
                                                                                                                    2⤵
                                                                                                                      PID:3668

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • memory/300-193-0x00000000008D0000-0x00000000008EE000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    120KB

                                                                                                                  • memory/300-167-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/332-162-0x0000000001190000-0x0000000001191000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/332-194-0x00000000003E0000-0x00000000003FE000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    120KB

                                                                                                                  • memory/804-170-0x0000000000B70000-0x0000000000B71000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1032-61-0x0000000003D70000-0x0000000003EAF000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.2MB

                                                                                                                  • memory/1032-60-0x0000000075591000-0x0000000075593000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1356-161-0x00000000002F0000-0x00000000002F1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1500-171-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1500-227-0x00000000004A0000-0x00000000004E9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    292KB

                                                                                                                  • memory/1500-221-0x00000000003E0000-0x00000000003F6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    88KB

                                                                                                                  • memory/1500-226-0x0000000004330000-0x00000000043AB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    492KB

                                                                                                                  • memory/1568-153-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1792-164-0x0000000000B00000-0x0000000000B01000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1804-177-0x0000000004180000-0x0000000004181000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1804-172-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1812-152-0x0000000000290000-0x0000000000291000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/2016-163-0x0000000000230000-0x000000000025F000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    188KB

                                                                                                                  • memory/2016-180-0x0000000004670000-0x000000000468A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    104KB

                                                                                                                  • memory/2016-178-0x0000000004570000-0x000000000458C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    112KB

                                                                                                                  • memory/2064-176-0x0000000000350000-0x0000000000351000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/2608-232-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                  • memory/2608-229-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                  • memory/2740-189-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    136KB

                                                                                                                  • memory/2740-181-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    136KB

                                                                                                                  • memory/2748-183-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                  • memory/2748-197-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                  • memory/2756-191-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                  • memory/2756-184-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                  • memory/2948-203-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                  • memory/3000-208-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                  • memory/3028-210-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    36KB