Overview

overview

10

Static

static

1

Anime-Figh...24.exe

windows7_x64

8

Anime-Figh...24.exe

windows7_x64

10

Anime-Figh...24.exe

windows7_x64

10

Anime-Figh...24.exe

windows7_x64

8

Anime-Figh...24.exe

windows11_x64

8

Anime-Figh...24.exe

windows10_x64

10

Anime-Figh...24.exe

windows10_x64

Anime-Figh...24.exe

windows10_x64

10

Anime-Figh...24.exe

windows10_x64

10

Anime-Figh...24.exe

windows10_x64

10

Resubmissions

02-09-2021 19:12

210902-xwla1aeefq 10

02-09-2021 19:09

210902-xtsbjabea9 8

Analysis

  • max time kernel
    583s
  • max time network
    588s
  • platform
    windows10_x64
  • resource
    win10-de
  • submitted
    02-09-2021 19:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Anime-Fighters-Infin_734316524.exe

  • Size

    3.9MB

  • MD5

    bd2b73492acf20dec004360b1605032d

  • SHA1

    60ddf3c107d94bbeb102a2d7ede945eb5edd2b35

  • SHA256

    12b6272825140a15eabec58f97b49aed3ce5db7816a0b3c2674f6ae8746367ca

  • SHA512

    dae236259e32a9e4b789f020dbd8082b376e3c2b56fd94523a44cf4b5a557f3661aeefc24b5605218ba0479ee1b9a8cb7b5c1df6c103673a99f13bc4210c90da

Score
10/10
discoverypersistencesuricataupx

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 3 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs
    persistence
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Blocklisted process makes network request 19 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 27 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 17 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 16 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe
    "C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3800
    • C:\Users\Admin\AppData\Local\Temp\is-LLNK5.tmp\Anime-Fighters-Infin_734316524.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-LLNK5.tmp\Anime-Fighters-Infin_734316524.tmp" /SL5="$20110,3656070,140800,C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Program Files (x86)\Vel\magnam\Expedita.exe
        "C:\Program Files (x86)\Vel/\magnam\Expedita.exe" 32cb7aca069a0c8bb8d51fccce1d3826
        3⤵
        • Executes dropped EXE
        PID:4052
        • C:\Users\Admin\AppData\Local\Temp\qkLSzCby\vpn.exe
          C:\Users\Admin\AppData\Local\Temp\qkLSzCby\vpn.exe /silent /subid=510x32cb7aca069a0c8bb8d51fccce1d3826
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4340
          • C:\Users\Admin\AppData\Local\Temp\is-0S68S.tmp\vpn.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-0S68S.tmp\vpn.tmp" /SL5="$202F6,15170975,270336,C:\Users\Admin\AppData\Local\Temp\qkLSzCby\vpn.exe" /silent /subid=510x32cb7aca069a0c8bb8d51fccce1d3826
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4412
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4520
              • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                tapinstall.exe remove tap0901
                7⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                PID:1860
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4136
              • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                tapinstall.exe install OemVista.inf tap0901
                7⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies system certificate store
                PID:5092
            • C:\Program Files (x86)\MaskVPN\mask_svc.exe
              "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4884
            • C:\Program Files (x86)\MaskVPN\mask_svc.exe
              "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4312
        • C:\Users\Admin\AppData\Local\Temp\g3fg9kBh\cc7CW1yeiBkiTS.exe
          "C:\Users\Admin\AppData\Local\Temp\g3fg9kBh\cc7CW1yeiBkiTS.exe" /usthree SUB=32cb7aca069a0c8bb8d51fccce1d3826
          4⤵
            PID:4460
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 656
              5⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              PID:2860
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 668
              5⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              PID:4360
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 768
              5⤵
              • Program crash
              PID:4100
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 820
              5⤵
              • Program crash
              PID:4932
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 884
              5⤵
              • Program crash
              PID:4160
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 904
              5⤵
              • Program crash
              PID:2120
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1164
              5⤵
              • Program crash
              PID:4380
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1148
              5⤵
              • Suspicious use of NtCreateProcessExOtherParentProcess
              • Program crash
              PID:5016
          • C:\Users\Admin\AppData\Local\Temp\nq6YpvzU\5BhlPIpvr5p.exe
            C:\Users\Admin\AppData\Local\Temp\nq6YpvzU\5BhlPIpvr5p.exe /quiet SILENT=1 AF=606x32cb7aca069a0c8bb8d51fccce1d3826
            4⤵
            • Loads dropped DLL
            • Enumerates connected drives
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4220
            • C:\Windows\SysWOW64\msiexec.exe
              "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=606x32cb7aca069a0c8bb8d51fccce1d3826 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\nq6YpvzU\5BhlPIpvr5p.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\nq6YpvzU\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630350492 /quiet SILENT=1 AF=606x32cb7aca069a0c8bb8d51fccce1d3826 " AF="606x32cb7aca069a0c8bb8d51fccce1d3826" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
              5⤵
                PID:4908
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4232
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
            C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
            3⤵
            • Modifies system executable filetype association
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4472
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe
              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:4848
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s seclogon
        1⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4444
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
        1⤵
          PID:4740
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:372
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
            • Enumerates connected drives
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4628
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 80CD0D071816074BC01FC23067530473 C
              2⤵
              • Loads dropped DLL
              PID:4808
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 33274634D22B543665A91E9D6A184F31
              2⤵
              • Blocklisted process makes network request
              • Loads dropped DLL
              PID:3584
            • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
              "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
              2⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:3960
              • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
                "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=606x32cb7aca069a0c8bb8d51fccce1d3826 -BF=default -uncf=default
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:4068
                • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                  "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--XUE1"
                  4⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:4652
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x1e0,0x1e4,0x1e8,0x1bc,0x1ec,0x7ff9c2479ec0,0x7ff9c2479ed0,0x7ff9c2479ee0
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4400
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1652 /prefetch:2
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:808
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --lang=de --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --mojo-platform-channel-handle=1724 /prefetch:8
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Modifies system certificate store
                    PID:2600
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --mojo-platform-channel-handle=2080 /prefetch:8
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4952
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2516 /prefetch:1
                    5⤵
                    • Executes dropped EXE
                    • Checks computer location settings
                    • Loads dropped DLL
                    PID:4872
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2172 /prefetch:2
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2660
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --mojo-platform-channel-handle=3300 /prefetch:8
                    5⤵
                    • Executes dropped EXE
                    PID:4516
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --mojo-platform-channel-handle=3204 /prefetch:8
                    5⤵
                    • Executes dropped EXE
                    PID:4088
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --mojo-platform-channel-handle=3264 /prefetch:8
                    5⤵
                    • Executes dropped EXE
                    PID:2792
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --mojo-platform-channel-handle=2676 /prefetch:8
                    5⤵
                    • Executes dropped EXE
                    PID:4912
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --lang=de --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --mojo-platform-channel-handle=2680 /prefetch:8
                    5⤵
                    • Executes dropped EXE
                    PID:4340
                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1572,5987869086054476787,4167863534502474126,131072 --lang=de --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4652_2064940924" --mojo-platform-channel-handle=1852 /prefetch:8
                    5⤵
                    • Executes dropped EXE
                    PID:4708
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_BE7E.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites' -retry_count 10"
                3⤵
                • Blocklisted process makes network request
                PID:4252
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of WriteProcessMemory
            PID:2768
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4dd723f1-ff95-0847-928d-2d5a25dd4c5f}\oemvista.inf" "9" "4d14a44ff" "0000000000000180" "WinSta0\Default" "0000000000000184" "208" "c:\program files (x86)\maskvpn\driver\win764"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:804
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000017C"
              2⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              PID:1244
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
            1⤵
              PID:3844
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
              1⤵
              • Checks SCSI registry key(s)
              PID:4660
            • C:\Program Files (x86)\MaskVPN\mask_svc.exe
              "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Modifies data under HKEY_USERS
              PID:4520
              • C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
                MaskVPNUpdate.exe /silent
                2⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:4252

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1624-120-0x0000000002490000-0x0000000002491000-memory.dmp

              Filesize

              4KB

              Download

            • memory/3800-119-0x0000000000400000-0x000000000042D000-memory.dmp

              Filesize

              180KB

              Download

            • memory/4252-270-0x0000000006623000-0x0000000006624000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-245-0x0000000006B80000-0x0000000006B81000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-253-0x0000000007D40000-0x0000000007D41000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-300-0x0000000000A70000-0x0000000000BBA000-memory.dmp

              Filesize

              1.3MB

              Download

            • memory/4252-251-0x0000000007830000-0x0000000007831000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-271-0x0000000006624000-0x0000000006626000-memory.dmp

              Filesize

              8KB

              Download

            • memory/4252-252-0x0000000007E70000-0x0000000007E71000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-249-0x0000000006C20000-0x0000000006C21000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-248-0x00000000074E0000-0x00000000074E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-247-0x0000000007290000-0x0000000007291000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-246-0x0000000007470000-0x0000000007471000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-250-0x0000000007940000-0x0000000007941000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-244-0x0000000006900000-0x0000000006901000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-242-0x0000000006620000-0x0000000006621000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-240-0x00000000043A0000-0x00000000043A1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-241-0x0000000006C60000-0x0000000006C61000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4252-243-0x0000000006622000-0x0000000006623000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4312-224-0x00000000017E0000-0x000000000192A000-memory.dmp

              Filesize

              1.3MB

              Download

            • memory/4312-223-0x0000000000400000-0x00000000015D7000-memory.dmp

              Filesize

              17.8MB

              Download

            • memory/4312-222-0x0000000001930000-0x0000000001931000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4312-221-0x0000000001920000-0x0000000001921000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4340-151-0x0000000000400000-0x000000000044C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/4412-214-0x0000000003040000-0x0000000003041000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4412-150-0x0000000002B00000-0x0000000002DE0000-memory.dmp

              Filesize

              2.9MB

              Download

            • memory/4412-152-0x00000000006A0000-0x00000000006A1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4412-213-0x0000000004B40000-0x0000000004B41000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4412-157-0x0000000004B50000-0x0000000004B5F000-memory.dmp

              Filesize

              60KB

              Download

            • memory/4412-160-0x0000000004E00000-0x0000000004E15000-memory.dmp

              Filesize

              84KB

              Download

            • memory/4460-161-0x0000000004760000-0x00000000047A8000-memory.dmp

              Filesize

              288KB

              Download

            • memory/4460-162-0x0000000000400000-0x0000000002B5E000-memory.dmp

              Filesize

              39.4MB

              Download

            • memory/4520-230-0x00000000343D0000-0x0000000034528000-memory.dmp

              Filesize

              1.3MB

              Download

            • memory/4520-229-0x0000000033A50000-0x0000000033C16000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4520-228-0x00000000001F0000-0x00000000001F1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4520-231-0x0000000034530000-0x0000000034588000-memory.dmp

              Filesize

              352KB

              Download

            • memory/4520-226-0x00000000018E0000-0x00000000018E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4520-227-0x0000000000400000-0x00000000015D7000-memory.dmp

              Filesize

              17.8MB

              Download

            • memory/4884-218-0x0000000000400000-0x00000000015D7000-memory.dmp

              Filesize

              17.8MB

              Download

            • memory/4884-216-0x0000000000160000-0x0000000000161000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4884-217-0x0000000000170000-0x0000000000171000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4884-219-0x00000000000D0000-0x000000000017E000-memory.dmp

              Filesize

              696KB

              Download