Overview
overview
10Static
static
Setup (1).exe
windows7_x64
10Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
10Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
10Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
10Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
10Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
15-10-2024 15:36
241015-s1zlzasdkc 1001-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 10Analysis
-
max time kernel
603s -
max time network
636s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
01-09-2021 05:12
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210408
gluptebametasploitredlinesmokeloadervidar131.08norman2spnewportspectrbackdoordiscoverydropperevasioninfostealerloaderspywarestealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
gluptebametasploitredlinesmokeloadervidarmix01.09norman2backdoordropperevasioninfostealerloaderstealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
redlinesmokeloadervidar131.08norman2spnewportspectrbackdoordiscoveryevasioninfostealerstealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
gluptebametasploitredlinevidar131.08norman2spnewportspectrbackdoordiscoverydropperevasioninfostealerloaderstealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210410
redlinesmokeloadervidar131.08norman2spnewportspectrbackdoordiscoveryevasioninfostealerstealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210410
gluptebametasploitredlinesmokeloadervidar131.08norman2spnewportspectrbackdoordiscoverydropperevasioninfostealerloaderstealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
gluptebametasploitredlinesmokeloadervidar131.08norman2spnewportspectrbackdoordropperevasioninfostealerloaderspywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210408
redlinevidar131.08norman2spnewportspectrdiscoveryevasioninfostealerspywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210410
redlinesmokeloadervidar31.08norman2spnewportspectrbackdoorevasioninfostealerstealersuricatathemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
gluptebametasploitredlinesmokeloadervidar131.08norman2spnewportspectrbackdoordropperevasioninfostealerloaderstealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
redlinesmokeloadervidar131.08norman2spnewportspectrbackdoordiscoveryevasioninfostealerstealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
gluptebametasploitredlinesmokeloadervidar131.08norman2spnewportspectrbackdoordiscoverydropperevasioninfostealerloaderstealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210408
gluptebametasploitredlinevidar131.08backdoordiscoverydropperevasioninfostealerloaderspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210410
gluptebametasploitredlinesmokeloadervidar131.08norman2spnewportspectrbackdoordropperevasioninfostealerloaderstealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
gluptebametasploitredlinesmokeloader1mix01.09spnewportspectrbackdoordropperevasioninfostealerloaderthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
gluptebametasploitredlinesmokeloadervidar131.08norman2spnewportspectrbackdoordiscoverydropperevasioninfostealerloaderstealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
redlinesmokeloadervidar131.08norman2spnewportspectrbackdoordiscoveryevasioninfostealerspywarestealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
Setup (18).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 25 IoCs
pid Process 1060 HR_I8q_jRCIwUVnHpwBTBzEZ.exe 1404 hYeTg7SLXoBhradsZOhsfHs0.exe 1084 wl_igPoBPJdTagROltDI7Kok.exe 1952 3ArLbDob_HWhpEVOuYJbrgLB.exe 840 c2IispnL0gtNLJYHt6JgxkCp.exe 1332 HR_I8q_jRCIwUVnHpwBTBzEZ.exe 1752 dM7aiWa5DqNJ4FXntPjcFwyU.exe 1540 ThaZAu_Hhq7WWqkMbsu0jKR6.exe 1064 piNa3eN02lQAOjP6DwGPwheD.exe 564 Ax8Fri3aYWWa7UAkXJIOA0hH.exe 1812 E94BzeZeQIO0cE74yKHYez_9.exe 1600 wfykqoZ0VknSw0BpjTB7SwkQ.exe 980 dzaP_OGxt0YIXugJRefhpL2y.exe 2028 QgQWUWA0w7cyjzL0zZphOJ00.exe 1368 17OyHarYqDiLA_Mo9ElY9Nus.exe 1848 jOhEJycyaUHiJPDikp1fnGwE.exe 800 wLxJo2PdJ6kiHpwFo6JHanx1.exe 1364 f7wJDgkXXZF4qIV_VAxr1KzE.exe 1556 QoaMKLnnvr5g7bTT3hPxcF4Y.exe 1784 6sa7auKa7nJDJwsgzyqZ0Udn.exe 1324 17OyHarYqDiLA_Mo9ElY9Nus.tmp 1140 E94BzeZeQIO0cE74yKHYez_9.exe 2388 53640396173.exe 2424 14796489038.exe 2516 03671724379.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion piNa3eN02lQAOjP6DwGPwheD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion piNa3eN02lQAOjP6DwGPwheD.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation Setup (18).exe -
Loads dropped DLL 43 IoCs
pid Process 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1928 Setup (18).exe 1368 17OyHarYqDiLA_Mo9ElY9Nus.exe 1324 17OyHarYqDiLA_Mo9ElY9Nus.tmp 1324 17OyHarYqDiLA_Mo9ElY9Nus.tmp 1324 17OyHarYqDiLA_Mo9ElY9Nus.tmp 1952 3ArLbDob_HWhpEVOuYJbrgLB.exe 1952 3ArLbDob_HWhpEVOuYJbrgLB.exe 1952 3ArLbDob_HWhpEVOuYJbrgLB.exe 1952 3ArLbDob_HWhpEVOuYJbrgLB.exe 2284 cmd.exe 2332 cmd.exe 2332 cmd.exe 2380 cmd.exe -
resource yara_rule behavioral19/files/0x0003000000013154-87.dat themida behavioral19/files/0x0003000000013154-104.dat themida behavioral19/files/0x0003000000013171-147.dat themida behavioral19/files/0x0003000000013171-120.dat themida behavioral19/memory/1064-179-0x0000000001060000-0x0000000001061000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA piNa3eN02lQAOjP6DwGPwheD.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 118 ip-api.com 126 ipinfo.io 128 ipinfo.io 21 ipinfo.io 22 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1064 piNa3eN02lQAOjP6DwGPwheD.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1060 set thread context of 1332 1060 HR_I8q_jRCIwUVnHpwBTBzEZ.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 2604 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 piNa3eN02lQAOjP6DwGPwheD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Setup (18).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (18).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Setup (18).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Setup (18).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (18).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C 17OyHarYqDiLA_Mo9ElY9Nus.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 17OyHarYqDiLA_Mo9ElY9Nus.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e piNa3eN02lQAOjP6DwGPwheD.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e piNa3eN02lQAOjP6DwGPwheD.exe -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 130 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 127 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 128 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1928 Setup (18).exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 564 Ax8Fri3aYWWa7UAkXJIOA0hH.exe Token: SeDebugPrivilege 2604 taskkill.exe Token: SeDebugPrivilege 1064 piNa3eN02lQAOjP6DwGPwheD.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1324 17OyHarYqDiLA_Mo9ElY9Nus.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1060 1928 Setup (18).exe 31 PID 1928 wrote to memory of 1060 1928 Setup (18).exe 31 PID 1928 wrote to memory of 1060 1928 Setup (18).exe 31 PID 1928 wrote to memory of 1060 1928 Setup (18).exe 31 PID 1060 wrote to memory of 1332 1060 HR_I8q_jRCIwUVnHpwBTBzEZ.exe 33 PID 1060 wrote to memory of 1332 1060 HR_I8q_jRCIwUVnHpwBTBzEZ.exe 33 PID 1060 wrote to memory of 1332 1060 HR_I8q_jRCIwUVnHpwBTBzEZ.exe 33 PID 1060 wrote to memory of 1332 1060 HR_I8q_jRCIwUVnHpwBTBzEZ.exe 33 PID 1060 wrote to memory of 1332 1060 HR_I8q_jRCIwUVnHpwBTBzEZ.exe 33 PID 1060 wrote to memory of 1332 1060 HR_I8q_jRCIwUVnHpwBTBzEZ.exe 33 PID 1060 wrote to memory of 1332 1060 HR_I8q_jRCIwUVnHpwBTBzEZ.exe 33 PID 1928 wrote to memory of 1404 1928 Setup (18).exe 32 PID 1928 wrote to memory of 1404 1928 Setup (18).exe 32 PID 1928 wrote to memory of 1404 1928 Setup (18).exe 32 PID 1928 wrote to memory of 1404 1928 Setup (18).exe 32 PID 1928 wrote to memory of 1084 1928 Setup (18).exe 35 PID 1928 wrote to memory of 1084 1928 Setup (18).exe 35 PID 1928 wrote to memory of 1084 1928 Setup (18).exe 35 PID 1928 wrote to memory of 1084 1928 Setup (18).exe 35 PID 1928 wrote to memory of 840 1928 Setup (18).exe 34 PID 1928 wrote to memory of 840 1928 Setup (18).exe 34 PID 1928 wrote to memory of 840 1928 Setup (18).exe 34 PID 1928 wrote to memory of 840 1928 Setup (18).exe 34 PID 1928 wrote to memory of 1952 1928 Setup (18).exe 36 PID 1928 wrote to memory of 1952 1928 Setup (18).exe 36 PID 1928 wrote to memory of 1952 1928 Setup (18).exe 36 PID 1928 wrote to memory of 1952 1928 Setup (18).exe 36 PID 1928 wrote to memory of 1752 1928 Setup (18).exe 41 PID 1928 wrote to memory of 1752 1928 Setup (18).exe 41 PID 1928 wrote to memory of 1752 1928 Setup (18).exe 41 PID 1928 wrote to memory of 1752 1928 Setup (18).exe 41 PID 1928 wrote to memory of 1064 1928 Setup (18).exe 39 PID 1928 wrote to memory of 1064 1928 Setup (18).exe 39 PID 1928 wrote to memory of 1064 1928 Setup (18).exe 39 PID 1928 wrote to memory of 1064 1928 Setup (18).exe 39 PID 1928 wrote to memory of 1064 1928 Setup (18).exe 39 PID 1928 wrote to memory of 1064 1928 Setup (18).exe 39 PID 1928 wrote to memory of 1064 1928 Setup (18).exe 39 PID 1928 wrote to memory of 564 1928 Setup (18).exe 40 PID 1928 wrote to memory of 564 1928 Setup (18).exe 40 PID 1928 wrote to memory of 564 1928 Setup (18).exe 40 PID 1928 wrote to memory of 564 1928 Setup (18).exe 40 PID 1928 wrote to memory of 1244 1928 Setup (18).exe 38 PID 1928 wrote to memory of 1244 1928 Setup (18).exe 38 PID 1928 wrote to memory of 1244 1928 Setup (18).exe 38 PID 1928 wrote to memory of 1244 1928 Setup (18).exe 38 PID 1928 wrote to memory of 1540 1928 Setup (18).exe 37 PID 1928 wrote to memory of 1540 1928 Setup (18).exe 37 PID 1928 wrote to memory of 1540 1928 Setup (18).exe 37 PID 1928 wrote to memory of 1540 1928 Setup (18).exe 37 PID 1928 wrote to memory of 1812 1928 Setup (18).exe 45 PID 1928 wrote to memory of 1812 1928 Setup (18).exe 45 PID 1928 wrote to memory of 1812 1928 Setup (18).exe 45 PID 1928 wrote to memory of 1812 1928 Setup (18).exe 45 PID 1928 wrote to memory of 2028 1928 Setup (18).exe 55 PID 1928 wrote to memory of 2028 1928 Setup (18).exe 55 PID 1928 wrote to memory of 2028 1928 Setup (18).exe 55 PID 1928 wrote to memory of 2028 1928 Setup (18).exe 55 PID 1928 wrote to memory of 980 1928 Setup (18).exe 54 PID 1928 wrote to memory of 980 1928 Setup (18).exe 54 PID 1928 wrote to memory of 980 1928 Setup (18).exe 54 PID 1928 wrote to memory of 980 1928 Setup (18).exe 54 PID 1928 wrote to memory of 1600 1928 Setup (18).exe 53 PID 1928 wrote to memory of 1600 1928 Setup (18).exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (18).exe"C:\Users\Admin\AppData\Local\Temp\Setup (18).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\Documents\HR_I8q_jRCIwUVnHpwBTBzEZ.exe"C:\Users\Admin\Documents\HR_I8q_jRCIwUVnHpwBTBzEZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\Documents\HR_I8q_jRCIwUVnHpwBTBzEZ.exe"C:\Users\Admin\Documents\HR_I8q_jRCIwUVnHpwBTBzEZ.exe"3⤵
- Executes dropped EXE
PID:1332
-
-
-
C:\Users\Admin\Documents\hYeTg7SLXoBhradsZOhsfHs0.exe"C:\Users\Admin\Documents\hYeTg7SLXoBhradsZOhsfHs0.exe"2⤵
- Executes dropped EXE
PID:1404
-
-
C:\Users\Admin\Documents\c2IispnL0gtNLJYHt6JgxkCp.exe"C:\Users\Admin\Documents\c2IispnL0gtNLJYHt6JgxkCp.exe"2⤵
- Executes dropped EXE
PID:840
-
-
C:\Users\Admin\Documents\wl_igPoBPJdTagROltDI7Kok.exe"C:\Users\Admin\Documents\wl_igPoBPJdTagROltDI7Kok.exe"2⤵
- Executes dropped EXE
PID:1084
-
-
C:\Users\Admin\Documents\3ArLbDob_HWhpEVOuYJbrgLB.exe"C:\Users\Admin\Documents\3ArLbDob_HWhpEVOuYJbrgLB.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"3⤵PID:2200
-
-
-
C:\Users\Admin\Documents\ThaZAu_Hhq7WWqkMbsu0jKR6.exe"C:\Users\Admin\Documents\ThaZAu_Hhq7WWqkMbsu0jKR6.exe"2⤵
- Executes dropped EXE
PID:1540
-
-
C:\Users\Admin\Documents\2cZRRXojwhv0hKtYA2jQZCJv.exe"C:\Users\Admin\Documents\2cZRRXojwhv0hKtYA2jQZCJv.exe"2⤵PID:1244
-
-
C:\Users\Admin\Documents\piNa3eN02lQAOjP6DwGPwheD.exe"C:\Users\Admin\Documents\piNa3eN02lQAOjP6DwGPwheD.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
C:\Users\Admin\Documents\Ax8Fri3aYWWa7UAkXJIOA0hH.exe"C:\Users\Admin\Documents\Ax8Fri3aYWWa7UAkXJIOA0hH.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
C:\Users\Admin\Documents\dM7aiWa5DqNJ4FXntPjcFwyU.exe"C:\Users\Admin\Documents\dM7aiWa5DqNJ4FXntPjcFwyU.exe"2⤵
- Executes dropped EXE
PID:1752
-
-
C:\Users\Admin\Documents\E94BzeZeQIO0cE74yKHYez_9.exe"C:\Users\Admin\Documents\E94BzeZeQIO0cE74yKHYez_9.exe"2⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\Documents\E94BzeZeQIO0cE74yKHYez_9.exe"C:\Users\Admin\Documents\E94BzeZeQIO0cE74yKHYez_9.exe" -u3⤵
- Executes dropped EXE
PID:1140
-
-
-
C:\Users\Admin\Documents\f7wJDgkXXZF4qIV_VAxr1KzE.exe"C:\Users\Admin\Documents\f7wJDgkXXZF4qIV_VAxr1KzE.exe"2⤵
- Executes dropped EXE
PID:1364
-
-
C:\Users\Admin\Documents\B1bxbmTMdsrOrdwtyOIxnjHq.exe"C:\Users\Admin\Documents\B1bxbmTMdsrOrdwtyOIxnjHq.exe"2⤵PID:1912
-
-
C:\Users\Admin\Documents\QoaMKLnnvr5g7bTT3hPxcF4Y.exe"C:\Users\Admin\Documents\QoaMKLnnvr5g7bTT3hPxcF4Y.exe"2⤵
- Executes dropped EXE
PID:1556
-
-
C:\Users\Admin\Documents\uYwyo5pu4oMFkqbQGyDj8Kc7.exe"C:\Users\Admin\Documents\uYwyo5pu4oMFkqbQGyDj8Kc7.exe"2⤵PID:820
-
-
C:\Users\Admin\Documents\wLxJo2PdJ6kiHpwFo6JHanx1.exe"C:\Users\Admin\Documents\wLxJo2PdJ6kiHpwFo6JHanx1.exe"2⤵
- Executes dropped EXE
PID:800
-
-
C:\Users\Admin\Documents\17OyHarYqDiLA_Mo9ElY9Nus.exe"C:\Users\Admin\Documents\17OyHarYqDiLA_Mo9ElY9Nus.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\is-2NGCE.tmp\17OyHarYqDiLA_Mo9ElY9Nus.tmp"C:\Users\Admin\AppData\Local\Temp\is-2NGCE.tmp\17OyHarYqDiLA_Mo9ElY9Nus.tmp" /SL5="$1016A,138429,56832,C:\Users\Admin\Documents\17OyHarYqDiLA_Mo9ElY9Nus.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:1324
-
-
-
C:\Users\Admin\Documents\jOhEJycyaUHiJPDikp1fnGwE.exe"C:\Users\Admin\Documents\jOhEJycyaUHiJPDikp1fnGwE.exe"2⤵
- Executes dropped EXE
PID:1848
-
-
C:\Users\Admin\Documents\wfykqoZ0VknSw0BpjTB7SwkQ.exe"C:\Users\Admin\Documents\wfykqoZ0VknSw0BpjTB7SwkQ.exe"2⤵
- Executes dropped EXE
PID:1600
-
-
C:\Users\Admin\Documents\dzaP_OGxt0YIXugJRefhpL2y.exe"C:\Users\Admin\Documents\dzaP_OGxt0YIXugJRefhpL2y.exe"2⤵
- Executes dropped EXE
PID:980
-
-
C:\Users\Admin\Documents\QgQWUWA0w7cyjzL0zZphOJ00.exe"C:\Users\Admin\Documents\QgQWUWA0w7cyjzL0zZphOJ00.exe"2⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{JWIw-awcgJ-2ax5-yjoPC}\53640396173.exe"3⤵
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\{JWIw-awcgJ-2ax5-yjoPC}\53640396173.exe"C:\Users\Admin\AppData\Local\Temp\{JWIw-awcgJ-2ax5-yjoPC}\53640396173.exe"4⤵
- Executes dropped EXE
PID:2388
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{JWIw-awcgJ-2ax5-yjoPC}\14796489038.exe" /mix3⤵
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\{JWIw-awcgJ-2ax5-yjoPC}\14796489038.exe"C:\Users\Admin\AppData\Local\Temp\{JWIw-awcgJ-2ax5-yjoPC}\14796489038.exe" /mix4⤵
- Executes dropped EXE
PID:2424
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{JWIw-awcgJ-2ax5-yjoPC}\03671724379.exe" /mix3⤵
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\{JWIw-awcgJ-2ax5-yjoPC}\03671724379.exe"C:\Users\Admin\AppData\Local\Temp\{JWIw-awcgJ-2ax5-yjoPC}\03671724379.exe" /mix4⤵
- Executes dropped EXE
PID:2516
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "QgQWUWA0w7cyjzL0zZphOJ00.exe" /f & erase "C:\Users\Admin\Documents\QgQWUWA0w7cyjzL0zZphOJ00.exe" & exit3⤵PID:2532
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "QgQWUWA0w7cyjzL0zZphOJ00.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
-
-
C:\Users\Admin\Documents\6sa7auKa7nJDJwsgzyqZ0Udn.exe"C:\Users\Admin\Documents\6sa7auKa7nJDJwsgzyqZ0Udn.exe"2⤵
- Executes dropped EXE
PID:1784
-