glupteba | 96b3a6f88bebb213230bd38f95804466296c238e0774861ceec6ad4424dcfb45

Analysis

max time kernel
72s
max time network
152s
platform
windows7_x64
resource
win7-en
submitted
05-09-2021 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

500A3B64014DE00B03F981299586FAE6.exe
Size

5.5MB
MD5

500a3b64014de00b03f981299586fae6
SHA1

268186377c6306055e8c42c1a1bde48adcb735b2
SHA256

96b3a6f88bebb213230bd38f95804466296c238e0774861ceec6ad4424dcfb45
SHA512

fb0f4b59aa74754056252edf1ddc0b4d6fc8a983aa1ff638030bec8b129141915b407b812a4a26c01e65b5b0ed259daab7bcadbb8d9f4c9a53c4d61295629085

Malware Config

Extracted

Family

vidar

Version

40.3

Botnet

706

https://lenko349.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

Botnet

pab777

185.215.113.15:6043

Extracted

Family

raccoon

Botnet

b8ef25fa9e346b7a31e4b6ff160623dd5fed2474

Attributes

url4cnc
https://telete.in/iphbarberleo

rc4.plain

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

vidar

Version

40.4

Botnet

937

https://romkaxarit.tumblr.com/

Attributes

profile_id
937

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2932-317-0x0000000000400000-0x0000000002F7A000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2684	rundll32.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	2684	rundll32.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5740	2684	rundll32.exe	61

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1544-198-0x00000000023A0000-0x00000000023BF000-memory.dmp	family_redline
behavioral1/memory/1544-226-0x0000000003970000-0x000000000398E000-memory.dmp	family_redline

VKeylogger
A keylogger first seen in Nov 2020.
stealer keylogger vkeylogger

VKeylogger Payload 2 IoCs

resource	yara_rule
behavioral1/memory/2076-281-0x00000000001D0000-0x00000000001DE000-memory.dmp	family_vkeylogger
behavioral1/memory/2076-291-0x0000000000400000-0x0000000002CBE000-memory.dmp	family_vkeylogger

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral1/memory/2004-184-0x0000000000400000-0x00000000021D9000-memory.dmp	family_vidar
behavioral1/memory/2692-378-0x00000000021D0000-0x00000000022A3000-memory.dmp	family_vidar
behavioral1/memory/2692-392-0x0000000000400000-0x00000000021CA000-memory.dmp	family_vidar

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0001000000012f12-61.dat	aspack_v212_v242
behavioral1/files/0x0001000000012f12-62.dat	aspack_v212_v242
behavioral1/files/0x0003000000012f0b-97.dat	aspack_v212_v242
behavioral1/files/0x0003000000012f0b-96.dat	aspack_v212_v242
behavioral1/files/0x0002000000012f11-95.dat	aspack_v212_v242
behavioral1/files/0x0002000000012f11-94.dat	aspack_v212_v242
behavioral1/files/0x0002000000012f15-101.dat	aspack_v212_v242
behavioral1/files/0x0002000000012f15-100.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
1772	setup_install.exe
1592	58a51f2acaa24098.exe
540	setup_install.exe
1700	Wed17973b80f1b7ee.exe
2004	Wed1721b23025489.exe
1536	Wed17631ea38e1e.exe
1916	Wed170a535c2d00d.exe
1596	Wed17c84299447a8.exe
1544	Wed17403981be039da9.exe
1752	Wed17b6b5708e5.exe
2040	Wed17f8546734.exe
2352	Wed17b6b5708e5.exe
2512	KiffApp2.exe
2672	LzmwAqmV.exe
2756	Chrome 5.exe
2808	PublicDwlBrowser1100.exe
2832	2.exe
2884	setup.exe
2924	setup_2.exe
2956	3002.exe
3064	setup_2.tmp
2084	2074934.exe
1324	setup_2.exe
1912	jhuuee.exe
1232	KFYwn0U_VpM_ENC87VUCnDSk.exe
2564	ck8k5Z_qNaKW8feD_WWH9zbw.exe
2932	X2SP13GkhGsBuT2ezLf_c7kh.exe
2984	DoeRi26jcuUSlnnhCr77eOwi.exe
2612	NyLnMtF2Qzr11ziuneyLCdSl.exe
2944	rZdS9t8KP2SHiD0vmuFFWDgG.exe
2992	aAAZreeDMJ18Qx4ftALr1jk_.exe
2784	90XjXU3Rq3bdc1ZwZl6nCYeV.exe
2720	YwpLAdaDeJUIRc4huJoeGi4C.exe
1724	n3Sord5dl4xUY9YOwrhoBmxz.exe
2076	NtP2pdontCFD0auBBm3cJt8n.exe
2536	eEGcW0uN9Y0m8avA9K2iXEfP.exe
2620	MmuyhJz63in5CuVBgNfbzOpX.exe
2840	9OFWs71UuiX_CxwNhEOXtFAm.exe
2568	e7UqabIFHnZ5jucWQ6OlJhbM.exe
1816	0o79AoC9bjyux5ut_H_LB96n.exe
2248	3w6zhi4oPTpNiVaVgtjHmYJs.exe
1736	vrqayrpyVc2fkhuZfoV96WsT.exe
2692	4n7I28LAsMPdlb7SVjGfeNGb.exe
2576	j7apSTZp1RKG9sGQcZkJrBzO.exe
2012	DdyaLq_q8trtfVPV4LhMdHSN.exe
2632	GLdrXtwShbp3E3aVbQInkCw9.exe
1340	_V6ynP0WX_irx5uwJkRyNjeS.exe
2616	CBJMY3AXGNzvdHdE66ZH5haA.exe
2656	7pRd_QyU5_GUi1TPINpxzfPD.exe
844	yGApNy1Py1UwyBhJgc7Gotpt.exe
2104	3002.exe
1740	setup_2.tmp
288	3525811.exe
2488	BearVpn 3.exe
2384	1885086.exe
956	7195614.exe
2376	5189010.exe
240	3574700.exe
760	3827216.exe
1348	7116366.exe
1448	cutm3.exe
1992	inst001.exe
2804	md8_8eus.exe
3108	1251107.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aAAZreeDMJ18Qx4ftALr1jk_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aAAZreeDMJ18Qx4ftALr1jk_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	90XjXU3Rq3bdc1ZwZl6nCYeV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e7UqabIFHnZ5jucWQ6OlJhbM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7195614.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7195614.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rZdS9t8KP2SHiD0vmuFFWDgG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rZdS9t8KP2SHiD0vmuFFWDgG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	90XjXU3Rq3bdc1ZwZl6nCYeV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e7UqabIFHnZ5jucWQ6OlJhbM.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Control Panel\International\Geo\Nation	Wed17f8546734.exe

Loads dropped DLL 64 IoCs

pid	Process
1080	500A3B64014DE00B03F981299586FAE6.exe
1080	500A3B64014DE00B03F981299586FAE6.exe
1080	500A3B64014DE00B03F981299586FAE6.exe
1772	setup_install.exe
1772	setup_install.exe
1772	setup_install.exe
1772	setup_install.exe
1772	setup_install.exe
1772	setup_install.exe
1772	setup_install.exe
1456	cmd.exe
1592	58a51f2acaa24098.exe
1592	58a51f2acaa24098.exe
1592	58a51f2acaa24098.exe
1592	58a51f2acaa24098.exe
1592	58a51f2acaa24098.exe
540	setup_install.exe
540	setup_install.exe
540	setup_install.exe
540	setup_install.exe
540	setup_install.exe
540	setup_install.exe
540	setup_install.exe
1716	cmd.exe
1344	cmd.exe
1344	cmd.exe
2004	Wed1721b23025489.exe
2004	Wed1721b23025489.exe
1340	cmd.exe
804	cmd.exe
1232	cmd.exe
2024	cmd.exe
384	cmd.exe
384	cmd.exe
1516	cmd.exe
1596	Wed17c84299447a8.exe
1596	Wed17c84299447a8.exe
1544	Wed17403981be039da9.exe
1544	Wed17403981be039da9.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
1752	Wed17b6b5708e5.exe
1752	Wed17b6b5708e5.exe
1752	Wed17b6b5708e5.exe
2352	Wed17b6b5708e5.exe
2352	Wed17b6b5708e5.exe
1596	Wed17c84299447a8.exe
1596	Wed17c84299447a8.exe
1596	Wed17c84299447a8.exe
1596	Wed17c84299447a8.exe
2672	LzmwAqmV.exe
2672	LzmwAqmV.exe
2672	LzmwAqmV.exe
2672	LzmwAqmV.exe
2672	LzmwAqmV.exe
2672	LzmwAqmV.exe
2672	LzmwAqmV.exe
2924	setup_2.exe
2924	setup_2.exe
2884	setup.exe
2672	LzmwAqmV.exe
2672	LzmwAqmV.exe
2924	setup_2.exe
2672	LzmwAqmV.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	3525811.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rZdS9t8KP2SHiD0vmuFFWDgG.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e7UqabIFHnZ5jucWQ6OlJhbM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7195614.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	aAAZreeDMJ18Qx4ftALr1jk_.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	90XjXU3Rq3bdc1ZwZl6nCYeV.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ipinfo.io
29	ipinfo.io
140	ip-api.com
226	ipinfo.io
227	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2992	aAAZreeDMJ18Qx4ftALr1jk_.exe
2944	rZdS9t8KP2SHiD0vmuFFWDgG.exe
2784	90XjXU3Rq3bdc1ZwZl6nCYeV.exe
956	7195614.exe
2568	e7UqabIFHnZ5jucWQ6OlJhbM.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2076 set thread context of 2224	2076	NtP2pdontCFD0auBBm3cJt8n.exe	124
PID 2612 set thread context of 2704	2612	NyLnMtF2Qzr11ziuneyLCdSl.exe	122
PID 2248 set thread context of 3384	2248	3w6zhi4oPTpNiVaVgtjHmYJs.exe	136
PID 2612 set thread context of 3184	2612	NyLnMtF2Qzr11ziuneyLCdSl.exe	132
PID 2612 set thread context of 3476	2612	NyLnMtF2Qzr11ziuneyLCdSl.exe	139

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	DoeRi26jcuUSlnnhCr77eOwi.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	DoeRi26jcuUSlnnhCr77eOwi.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	DoeRi26jcuUSlnnhCr77eOwi.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	DoeRi26jcuUSlnnhCr77eOwi.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	DoeRi26jcuUSlnnhCr77eOwi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2116	2832	WerFault.exe	64
3056	2004	WerFault.exe	45

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3076	schtasks.exe
2596	schtasks.exe
3100	schtasks.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
3416	taskkill.exe
4048	taskkill.exe
2556	taskkill.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	PublicDwlBrowser1100.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Wed17f8546734.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Wed17f8546734.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Wed17f8546734.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	PublicDwlBrowser1100.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	174	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2012	powershell.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2040	Wed17f8546734.exe
2756	NyLnMtF2Qzr11ziuneyLCdSl.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2076	NtP2pdontCFD0auBBm3cJt8n.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1536	Wed17631ea38e1e.exe
Token: SeDebugPrivilege	1916	Wed170a535c2d00d.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2832	2.exe
Token: SeDebugPrivilege	2808	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	2512	KiffApp2.exe
Token: SeDebugPrivilege	2084	2074934.exe
Token: SeDebugPrivilege	2720	YwpLAdaDeJUIRc4huJoeGi4C.exe
Token: SeDebugPrivilege	2376	5189010.exe
Token: SeDebugPrivilege	2756	NyLnMtF2Qzr11ziuneyLCdSl.exe
Token: SeDebugPrivilege	1700	Wed17973b80f1b7ee.exe
Token: SeDebugPrivilege	2116	WerFault.exe
Token: SeDebugPrivilege	3392	2522011.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1772	1080	500A3B64014DE00B03F981299586FAE6.exe	26
PID 1080 wrote to memory of 1772	1080	500A3B64014DE00B03F981299586FAE6.exe	26
PID 1080 wrote to memory of 1772	1080	500A3B64014DE00B03F981299586FAE6.exe	26
PID 1080 wrote to memory of 1772	1080	500A3B64014DE00B03F981299586FAE6.exe	26
PID 1080 wrote to memory of 1772	1080	500A3B64014DE00B03F981299586FAE6.exe	26
PID 1080 wrote to memory of 1772	1080	500A3B64014DE00B03F981299586FAE6.exe	26
PID 1080 wrote to memory of 1772	1080	500A3B64014DE00B03F981299586FAE6.exe	26
PID 1772 wrote to memory of 1456	1772	setup_install.exe	28
PID 1772 wrote to memory of 1456	1772	setup_install.exe	28
PID 1772 wrote to memory of 1456	1772	setup_install.exe	28
PID 1772 wrote to memory of 1456	1772	setup_install.exe	28
PID 1772 wrote to memory of 1456	1772	setup_install.exe	28
PID 1772 wrote to memory of 1456	1772	setup_install.exe	28
PID 1772 wrote to memory of 1456	1772	setup_install.exe	28
PID 1456 wrote to memory of 1592	1456	cmd.exe	29
PID 1456 wrote to memory of 1592	1456	cmd.exe	29
PID 1456 wrote to memory of 1592	1456	cmd.exe	29
PID 1456 wrote to memory of 1592	1456	cmd.exe	29
PID 1456 wrote to memory of 1592	1456	cmd.exe	29
PID 1456 wrote to memory of 1592	1456	cmd.exe	29
PID 1456 wrote to memory of 1592	1456	cmd.exe	29
PID 1592 wrote to memory of 540	1592	58a51f2acaa24098.exe	34
PID 1592 wrote to memory of 540	1592	58a51f2acaa24098.exe	34
PID 1592 wrote to memory of 540	1592	58a51f2acaa24098.exe	34
PID 1592 wrote to memory of 540	1592	58a51f2acaa24098.exe	34
PID 1592 wrote to memory of 540	1592	58a51f2acaa24098.exe	34
PID 1592 wrote to memory of 540	1592	58a51f2acaa24098.exe	34
PID 1592 wrote to memory of 540	1592	58a51f2acaa24098.exe	34
PID 540 wrote to memory of 1296	540	setup_install.exe	36
PID 540 wrote to memory of 1296	540	setup_install.exe	36
PID 540 wrote to memory of 1296	540	setup_install.exe	36
PID 540 wrote to memory of 1296	540	setup_install.exe	36
PID 540 wrote to memory of 1296	540	setup_install.exe	36
PID 540 wrote to memory of 1296	540	setup_install.exe	36
PID 540 wrote to memory of 1296	540	setup_install.exe	36
PID 540 wrote to memory of 1232	540	setup_install.exe	38
PID 540 wrote to memory of 1232	540	setup_install.exe	38
PID 540 wrote to memory of 1232	540	setup_install.exe	38
PID 540 wrote to memory of 1232	540	setup_install.exe	38
PID 540 wrote to memory of 1232	540	setup_install.exe	38
PID 540 wrote to memory of 1232	540	setup_install.exe	38
PID 540 wrote to memory of 1232	540	setup_install.exe	38
PID 540 wrote to memory of 1716	540	setup_install.exe	37
PID 540 wrote to memory of 1716	540	setup_install.exe	37
PID 540 wrote to memory of 1716	540	setup_install.exe	37
PID 540 wrote to memory of 1716	540	setup_install.exe	37
PID 540 wrote to memory of 1716	540	setup_install.exe	37
PID 540 wrote to memory of 1716	540	setup_install.exe	37
PID 540 wrote to memory of 1716	540	setup_install.exe	37
PID 540 wrote to memory of 2024	540	setup_install.exe	48
PID 540 wrote to memory of 2024	540	setup_install.exe	48
PID 540 wrote to memory of 2024	540	setup_install.exe	48
PID 540 wrote to memory of 2024	540	setup_install.exe	48
PID 540 wrote to memory of 2024	540	setup_install.exe	48
PID 540 wrote to memory of 2024	540	setup_install.exe	48
PID 540 wrote to memory of 2024	540	setup_install.exe	48
PID 540 wrote to memory of 1344	540	setup_install.exe	41
PID 540 wrote to memory of 1344	540	setup_install.exe	41
PID 540 wrote to memory of 1344	540	setup_install.exe	41
PID 540 wrote to memory of 1344	540	setup_install.exe	41
PID 540 wrote to memory of 1344	540	setup_install.exe	41
PID 540 wrote to memory of 1344	540	setup_install.exe	41
PID 540 wrote to memory of 1344	540	setup_install.exe	41
PID 540 wrote to memory of 2020	540	setup_install.exe	39

C:\Users\Admin\AppData\Local\Temp\500A3B64014DE00B03F981299586FAE6.exe
"C:\Users\Admin\AppData\Local\Temp\500A3B64014DE00B03F981299586FAE6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\7zS834A53E3\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS834A53E3\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\58a51f2acaa24098.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\58a51f2acaa24098.exe
      C:\Users\Admin\AppData\Local\Temp\58a51f2acaa24098.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\setup_install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\setup_install.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:540
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed17973b80f1b7ee.exe
        6⤵
        Loads dropped DLL
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\Wed17973b80f1b7ee.exe
        
        Wed17973b80f1b7ee.exe
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\tmpE6C6_tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE6C6_tmp.exe"
        8⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        9⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Corpo.xlsx
        9⤵
        
        PID:5564
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed17b6b5708e5.exe
        6⤵
        Loads dropped DLL
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\Wed17b6b5708e5.exe
        
        Wed17b6b5708e5.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\Wed17b6b5708e5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\Wed17b6b5708e5.exe" -u
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2352
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed1737159769dee23c.exe
        6⤵
        
        PID:2020
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed1721b23025489.exe
        6⤵
        Loads dropped DLL
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\Wed1721b23025489.exe
        
        Wed1721b23025489.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 980
        8⤵
        Program crash
        
        PID:3056
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed17f8546734.exe
        6⤵
        Loads dropped DLL
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\Wed17f8546734.exe
        
        Wed17f8546734.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:2040
        
        C:\Users\Admin\Documents\KFYwn0U_VpM_ENC87VUCnDSk.exe
        
        "C:\Users\Admin\Documents\KFYwn0U_VpM_ENC87VUCnDSk.exe"
        8⤵
        Executes dropped EXE
        
        PID:1232
        
        C:\Users\Admin\Documents\j7apSTZp1RKG9sGQcZkJrBzO.exe
        
        "C:\Users\Admin\Documents\j7apSTZp1RKG9sGQcZkJrBzO.exe"
        8⤵
        Executes dropped EXE
        
        PID:2576
        
        C:\Users\Admin\Documents\7pRd_QyU5_GUi1TPINpxzfPD.exe
        
        "C:\Users\Admin\Documents\7pRd_QyU5_GUi1TPINpxzfPD.exe"
        8⤵
        Executes dropped EXE
        
        PID:2656
        
        C:\Users\Admin\Documents\DdyaLq_q8trtfVPV4LhMdHSN.exe
        
        "C:\Users\Admin\Documents\DdyaLq_q8trtfVPV4LhMdHSN.exe"
        8⤵
        Executes dropped EXE
        
        PID:2012
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\DdyaLq_q8trtfVPV4LhMdHSN.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\DdyaLq_q8trtfVPV4LhMdHSN.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
        9⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\DdyaLq_q8trtfVPV4LhMdHSN.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\DdyaLq_q8trtfVPV4LhMdHSN.exe" ) do taskkill /f -im "%~nxA"
        10⤵
        
        PID:3820
        
        C:\Users\Admin\Documents\GLdrXtwShbp3E3aVbQInkCw9.exe
        
        "C:\Users\Admin\Documents\GLdrXtwShbp3E3aVbQInkCw9.exe"
        8⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        9⤵
        
        PID:3312
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        10⤵
        
        PID:3552
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        9⤵
        
        PID:2244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7feee16a380,0x7feee16a390,0x7feee16a3a0
        10⤵
        
        PID:3376
        
        C:\Users\Admin\Documents\0o79AoC9bjyux5ut_H_LB96n.exe
        
        "C:\Users\Admin\Documents\0o79AoC9bjyux5ut_H_LB96n.exe"
        8⤵
        Executes dropped EXE
        
        PID:1816
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        "C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe"
        8⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:3036
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:3156
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:3416
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:3836
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:1616
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:752
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:1960
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:1644
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:2968
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:4252
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:4644
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:5024
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:4528
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:1908
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:4572
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:4640
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:3508
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:3368
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:4420
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:5124
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:5360
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:5528
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:5792
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:5956
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:6132
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:2264
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:1772
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        
        C:\Users\Admin\Documents\n3Sord5dl4xUY9YOwrhoBmxz.exe
        9⤵
        
        PID:5860
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        
        "C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe"
        8⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        9⤵
        
        PID:3668
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        9⤵
        
        PID:3960
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        9⤵
        
        PID:3096
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        9⤵
        
        PID:3764
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        9⤵
        
        PID:3132
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        9⤵
        
        PID:2364
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        9⤵
        
        PID:4232
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        
        C:\Users\Admin\Documents\MmuyhJz63in5CuVBgNfbzOpX.exe
        9⤵
        
        PID:4616
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        "C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2612
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:2704
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:3184
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:3476
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:3860
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:3468
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:1616
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:3852
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:2500
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:4448
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:4776
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:4212
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:4688
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:4372
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:5032
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:2864
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:3444
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:4064
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:2072
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:5352
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:5552
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:5804
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:5988
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:900
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:5464
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        
        C:\Users\Admin\Documents\NyLnMtF2Qzr11ziuneyLCdSl.exe
        9⤵
        
        PID:5696
        
        C:\Users\Admin\Documents\eEGcW0uN9Y0m8avA9K2iXEfP.exe
        
        "C:\Users\Admin\Documents\eEGcW0uN9Y0m8avA9K2iXEfP.exe"
        8⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "eEGcW0uN9Y0m8avA9K2iXEfP.exe" /f & erase "C:\Users\Admin\Documents\eEGcW0uN9Y0m8avA9K2iXEfP.exe" & exit
        9⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "eEGcW0uN9Y0m8avA9K2iXEfP.exe" /f
        10⤵
        Kills process with taskkill
        
        PID:2556
        
        C:\Users\Admin\Documents\ck8k5Z_qNaKW8feD_WWH9zbw.exe
        
        "C:\Users\Admin\Documents\ck8k5Z_qNaKW8feD_WWH9zbw.exe"
        8⤵
        Executes dropped EXE
        
        PID:2564
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "ck8k5Z_qNaKW8feD_WWH9zbw.exe" /f & erase "C:\Users\Admin\Documents\ck8k5Z_qNaKW8feD_WWH9zbw.exe" & exit
        9⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "ck8k5Z_qNaKW8feD_WWH9zbw.exe" /f
        10⤵
        Kills process with taskkill
        
        PID:3416
        
        C:\Users\Admin\Documents\NtP2pdontCFD0auBBm3cJt8n.exe
        
        "C:\Users\Admin\Documents\NtP2pdontCFD0auBBm3cJt8n.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2076
        
        C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        9⤵
        
        PID:2224
        
        C:\Users\Admin\Documents\vrqayrpyVc2fkhuZfoV96WsT.exe
        
        "C:\Users\Admin\Documents\vrqayrpyVc2fkhuZfoV96WsT.exe"
        8⤵
        Executes dropped EXE
        
        PID:1736
        
        C:\Users\Admin\Documents\vrqayrpyVc2fkhuZfoV96WsT.exe
        
        "C:\Users\Admin\Documents\vrqayrpyVc2fkhuZfoV96WsT.exe"
        9⤵
        
        PID:5300
        
        C:\Users\Admin\Documents\CBJMY3AXGNzvdHdE66ZH5haA.exe
        
        "C:\Users\Admin\Documents\CBJMY3AXGNzvdHdE66ZH5haA.exe"
        8⤵
        Executes dropped EXE
        
        PID:2616
        
        C:\Users\Admin\Documents\3w6zhi4oPTpNiVaVgtjHmYJs.exe
        
        "C:\Users\Admin\Documents\3w6zhi4oPTpNiVaVgtjHmYJs.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2248
        
        C:\Users\Admin\Documents\3w6zhi4oPTpNiVaVgtjHmYJs.exe
        
        "C:\Users\Admin\Documents\3w6zhi4oPTpNiVaVgtjHmYJs.exe"
        9⤵
        
        PID:3384
        
        C:\Users\Admin\Documents\_V6ynP0WX_irx5uwJkRyNjeS.exe
        
        "C:\Users\Admin\Documents\_V6ynP0WX_irx5uwJkRyNjeS.exe"
        8⤵
        Executes dropped EXE
        
        PID:1340
        
        C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
        
        "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
        9⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:2596
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3100
        
        C:\Users\Admin\Documents\90XjXU3Rq3bdc1ZwZl6nCYeV.exe
        
        "C:\Users\Admin\Documents\90XjXU3Rq3bdc1ZwZl6nCYeV.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\90XjXU3Rq3bdc1ZwZl6nCYeV.exe"
        9⤵
        
        PID:5412
        
        C:\Users\Admin\Documents\e7UqabIFHnZ5jucWQ6OlJhbM.exe
        
        "C:\Users\Admin\Documents\e7UqabIFHnZ5jucWQ6OlJhbM.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2568
        
        C:\Users\Admin\Documents\YwpLAdaDeJUIRc4huJoeGi4C.exe
        
        "C:\Users\Admin\Documents\YwpLAdaDeJUIRc4huJoeGi4C.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
        
        C:\Users\Admin\AppData\Roaming\2522011.exe
        
        "C:\Users\Admin\AppData\Roaming\2522011.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3392
        
        C:\Users\Admin\AppData\Roaming\8854870.exe
        
        "C:\Users\Admin\AppData\Roaming\8854870.exe"
        9⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Roaming\7466660.exe
        
        "C:\Users\Admin\AppData\Roaming\7466660.exe"
        9⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Roaming\8401859.exe
        
        "C:\Users\Admin\AppData\Roaming\8401859.exe"
        9⤵
        
        PID:3608
        
        C:\Users\Admin\Documents\4n7I28LAsMPdlb7SVjGfeNGb.exe
        
        "C:\Users\Admin\Documents\4n7I28LAsMPdlb7SVjGfeNGb.exe"
        8⤵
        Executes dropped EXE
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im 4n7I28LAsMPdlb7SVjGfeNGb.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\4n7I28LAsMPdlb7SVjGfeNGb.exe" & del C:\ProgramData\*.dll & exit
        9⤵
        
        PID:5800
        
        C:\Users\Admin\Documents\aAAZreeDMJ18Qx4ftALr1jk_.exe
        
        "C:\Users\Admin\Documents\aAAZreeDMJ18Qx4ftALr1jk_.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2992
        
        C:\Users\Admin\Documents\DoeRi26jcuUSlnnhCr77eOwi.exe
        
        "C:\Users\Admin\Documents\DoeRi26jcuUSlnnhCr77eOwi.exe"
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2984
        
        C:\Program Files (x86)\Company\NewProduct\inst001.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
        9⤵
        Executes dropped EXE
        
        PID:1992
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        9⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        9⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Users\Admin\Documents\X2SP13GkhGsBuT2ezLf_c7kh.exe
        
        "C:\Users\Admin\Documents\X2SP13GkhGsBuT2ezLf_c7kh.exe"
        8⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Users\Admin\Documents\rZdS9t8KP2SHiD0vmuFFWDgG.exe
        
        "C:\Users\Admin\Documents\rZdS9t8KP2SHiD0vmuFFWDgG.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2944
        
        C:\Users\Admin\Documents\9OFWs71UuiX_CxwNhEOXtFAm.exe
        
        "C:\Users\Admin\Documents\9OFWs71UuiX_CxwNhEOXtFAm.exe"
        8⤵
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        9⤵
        
        PID:4960
        
        C:\Users\Admin\Documents\yGApNy1Py1UwyBhJgc7Gotpt.exe
        
        "C:\Users\Admin\Documents\yGApNy1Py1UwyBhJgc7Gotpt.exe"
        8⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Users\Admin\Documents\yGApNy1Py1UwyBhJgc7Gotpt.exe
        
        "C:\Users\Admin\Documents\yGApNy1Py1UwyBhJgc7Gotpt.exe" -u
        9⤵
        
        PID:3084
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed17631ea38e1e.exe
        6⤵
        Loads dropped DLL
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\Wed17631ea38e1e.exe
        
        Wed17631ea38e1e.exe
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
        
        C:\Users\Admin\AppData\Roaming\2074934.exe
        
        "C:\Users\Admin\AppData\Roaming\2074934.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Users\Admin\AppData\Roaming\3525811.exe
        
        "C:\Users\Admin\AppData\Roaming\3525811.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:288
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        9⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Roaming\1885086.exe
        
        "C:\Users\Admin\AppData\Roaming\1885086.exe"
        8⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Users\Admin\AppData\Roaming\7195614.exe
        
        "C:\Users\Admin\AppData\Roaming\7195614.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:956
        
        C:\Users\Admin\AppData\Roaming\3574700.exe
        
        "C:\Users\Admin\AppData\Roaming\3574700.exe"
        8⤵
        Executes dropped EXE
        
        PID:240
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed17403981be039da9.exe
        6⤵
        Loads dropped DLL
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\Wed17403981be039da9.exe
        
        Wed17403981be039da9.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1544
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed170a535c2d00d.exe
        6⤵
        Loads dropped DLL
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\Wed170a535c2d00d.exe
        
        Wed170a535c2d00d.exe
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        9⤵
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        10⤵
        
        PID:804
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        11⤵
        Creates scheduled task(s)
        
        PID:3076
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        10⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        9⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
        
        C:\Users\Admin\AppData\Roaming\5189010.exe
        
        "C:\Users\Admin\AppData\Roaming\5189010.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
        
        C:\Users\Admin\AppData\Roaming\3827216.exe
        
        "C:\Users\Admin\AppData\Roaming\3827216.exe"
        10⤵
        Executes dropped EXE
        
        PID:760
        
        C:\Users\Admin\AppData\Roaming\7116366.exe
        
        "C:\Users\Admin\AppData\Roaming\7116366.exe"
        10⤵
        Executes dropped EXE
        
        PID:1348
        
        C:\Users\Admin\AppData\Roaming\1251107.exe
        
        "C:\Users\Admin\AppData\Roaming\1251107.exe"
        10⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Users\Admin\AppData\Roaming\8700318.exe
        
        "C:\Users\Admin\AppData\Roaming\8700318.exe"
        10⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2832 -s 1392
        10⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        10⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        11⤵
        Kills process with taskkill
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\is-QNSAK.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QNSAK.tmp\setup_2.tmp" /SL5="$101AA,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        10⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        11⤵
        Executes dropped EXE
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\is-9N0VE.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9N0VE.tmp\setup_2.tmp" /SL5="$101D2,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        12⤵
        Executes dropped EXE
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\is-V0UCH.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-V0UCH.tmp\postback.exe" ss1
        13⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        9⤵
        Executes dropped EXE
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        10⤵
        Executes dropped EXE
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        9⤵
        Executes dropped EXE
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        9⤵
        Executes dropped EXE
        
        PID:2488
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Wed17c84299447a8.exe
        6⤵
        Loads dropped DLL
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\7zS836DBA14\Wed17c84299447a8.exe
        
        Wed17c84299447a8.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffApp2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffApp2.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2056

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4528

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-108-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/540-109-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/540-119-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/540-115-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/540-113-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/540-106-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/540-121-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/540-107-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/540-110-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/540-146-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/956-381-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/1080-53-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/1324-240-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1536-177-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/1536-190-0x000000001AE40000-0x000000001AE42000-memory.dmp

Filesize
8KB

Download
memory/1536-186-0x0000000000240000-0x0000000000257000-memory.dmp

Filesize
92KB

Download
memory/1544-199-0x0000000003E31000-0x0000000003E32000-memory.dmp

Filesize
4KB

Download
memory/1544-226-0x0000000003970000-0x000000000398E000-memory.dmp

Filesize
120KB

Download
memory/1544-222-0x0000000003E33000-0x0000000003E34000-memory.dmp

Filesize
4KB

Download
memory/1544-243-0x0000000003E34000-0x0000000003E36000-memory.dmp

Filesize
8KB

Download
memory/1544-208-0x0000000003E32000-0x0000000003E33000-memory.dmp

Filesize
4KB

Download
memory/1544-198-0x00000000023A0000-0x00000000023BF000-memory.dmp

Filesize
124KB

Download
memory/1544-195-0x0000000000400000-0x0000000001D9A000-memory.dmp

Filesize
25.6MB

Download
memory/1544-194-0x0000000000250000-0x0000000000280000-memory.dmp

Filesize
192KB

Download
memory/1700-171-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/1700-324-0x000000001B166000-0x000000001B185000-memory.dmp

Filesize
124KB

Download
memory/1700-187-0x000000001B160000-0x000000001B162000-memory.dmp

Filesize
8KB

Download
memory/1700-188-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/1724-301-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/1736-365-0x00000000075C0000-0x00000000075C1000-memory.dmp

Filesize
4KB

Download
memory/1740-374-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1772-76-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1772-74-0x0000000061880000-0x00000000618B7000-memory.dmp

Filesize
220KB

Download
memory/1772-75-0x0000000061880000-0x00000000618B7000-memory.dmp

Filesize
220KB

Download
memory/1772-72-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1772-77-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1772-73-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1916-189-0x000000001ABE0000-0x000000001ABE2000-memory.dmp

Filesize
8KB

Download
memory/1916-170-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/2004-178-0x0000000002750000-0x0000000004529000-memory.dmp

Filesize
29.8MB

Download
memory/2004-184-0x0000000000400000-0x00000000021D9000-memory.dmp

Filesize
29.8MB

Download
memory/2012-185-0x0000000001E40000-0x0000000002A8A000-memory.dmp

Filesize
12.3MB

Download
memory/2040-200-0x0000000003FB0000-0x00000000040EF000-memory.dmp

Filesize
1.2MB

Download
memory/2076-291-0x0000000000400000-0x0000000002CBE000-memory.dmp

Filesize
40.7MB

Download
memory/2076-281-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/2084-232-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/2084-246-0x000000001AC70000-0x000000001AC72000-memory.dmp

Filesize
8KB

Download
memory/2084-244-0x00000000003D0000-0x000000000040E000-memory.dmp

Filesize
248KB

Download
memory/2116-231-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Filesize
8KB

Download
memory/2116-358-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2248-329-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/2376-314-0x000000001AF20000-0x000000001AF22000-memory.dmp

Filesize
8KB

Download
memory/2512-196-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/2512-237-0x000000001B3B0000-0x000000001B3B2000-memory.dmp

Filesize
8KB

Download
memory/2512-319-0x000000001B3B6000-0x000000001B3D5000-memory.dmp

Filesize
124KB

Download
memory/2536-308-0x0000000000400000-0x0000000002B59000-memory.dmp

Filesize
39.3MB

Download
memory/2536-307-0x0000000000240000-0x000000000026F000-memory.dmp

Filesize
188KB

Download
memory/2564-310-0x0000000000400000-0x000000000216C000-memory.dmp

Filesize
29.4MB

Download
memory/2564-309-0x0000000000260000-0x000000000028F000-memory.dmp

Filesize
188KB

Download
memory/2576-390-0x0000000002D00000-0x0000000002D4D000-memory.dmp

Filesize
308KB

Download
memory/2612-304-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/2620-344-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/2672-203-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2692-378-0x00000000021D0000-0x00000000022A3000-memory.dmp

Filesize
844KB

Download
memory/2692-392-0x0000000000400000-0x00000000021CA000-memory.dmp

Filesize
29.8MB

Download
memory/2720-292-0x000000001B0B0000-0x000000001B0B2000-memory.dmp

Filesize
8KB

Download
memory/2756-206-0x000000013FE30000-0x000000013FE31000-memory.dmp

Filesize
4KB

Download
memory/2756-299-0x0000000000840000-0x0000000000842000-memory.dmp

Filesize
8KB

Download
memory/2784-313-0x0000000000100000-0x0000000000623000-memory.dmp

Filesize
5.1MB

Download
memory/2784-290-0x0000000000100000-0x0000000000623000-memory.dmp

Filesize
5.1MB

Download
memory/2808-210-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2808-216-0x00000000004F0000-0x0000000000507000-memory.dmp

Filesize
92KB

Download
memory/2808-225-0x000000001AF70000-0x000000001AF72000-memory.dmp

Filesize
8KB

Download
memory/2832-213-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/2832-223-0x000000001B150000-0x000000001B152000-memory.dmp

Filesize
8KB

Download
memory/2840-377-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/2884-238-0x0000000002830000-0x00000000045AA000-memory.dmp

Filesize
29.5MB

Download
memory/2884-242-0x0000000000400000-0x000000000217A000-memory.dmp

Filesize
29.5MB

Download
memory/2924-224-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2932-317-0x0000000000400000-0x0000000002F7A000-memory.dmp

Filesize
43.5MB

Download
memory/2932-316-0x0000000003550000-0x00000000060CA000-memory.dmp

Filesize
43.5MB

Download
memory/2944-318-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/2992-311-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/3064-241-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3392-343-0x000000001AD50000-0x000000001AD52000-memory.dmp

Filesize
8KB

Download