arkei | bb1944681aa2fcfd5f372fd44e041a63569b46130540225afc1560a1650d4e37

Analysis

max time kernel
151s
max time network
151s
platform
windows10_x64
resource
win10-en-20211104
submitted
17/11/2021, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a60ffe0827afc57455926459836281f.exe
Size 312KB
Sample211117-e8y4hsebem
SHA256 bb1944681aa2fcfd5f372fd44e041a63569b46130540225afc1560a1650d4e37
MD5 9a60ffe0827afc57455926459836281f
SHA1 c3a6616342f845659f35de8db3c3f7038acd06fa
SHA512 a4a744d3fbf8ee8a4ba20e909e530f0085988f9fd01940775370f2e9180929c6a84a08586a93ea51a2d161f41db3a4159f9e01da23bba72f2509cdd6c8917365
MD5 SHA1 SHA512

Score

10^/10

arkei metasploit raccoon redline socelars vidar 937 ddf183af4241e3172885cf1b2c4c1fb4ee03d05a luna2121 udptest backdoor discovery evasion infostealer spyware stealer suricata themida trojan

Malware Config

Extracted

Family

socelars

http://www.gianninidesign.com/

Extracted

Family

redline

Botnet

udptest

193.56.146.64:65441

Extracted

Family

redline

Botnet

luna2121

135.181.129.119:4805

Extracted

Family

vidar

Version

48.5

Botnet

https://koyu.space/@tttaj

Attributes

profile_id
937

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

ddf183af4241e3172885cf1b2c4c1fb4ee03d05a

Attributes

url4cnc
http://91.219.236.27/capibar

http://5.181.156.92/capibar

http://91.219.236.207/capibar

http://185.225.19.18/capibar

http://91.219.237.227/capibar

https://t.me/capibar

rc4.plain

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

resource	yara_rule
behavioral2/memory/2780-180-0x0000000002330000-0x000000000235E000-memory.dmp	family_redline
behavioral2/memory/2780-184-0x0000000004F20000-0x0000000004F4C000-memory.dmp	family_redline
behavioral2/memory/688-243-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/688-244-0x0000000000418F0E-mapping.dmp	family_redline
behavioral2/memory/1352-381-0x0000000000418F12-mapping.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000400000001ac03-146.dat	family_socelars
behavioral2/files/0x000400000001ac03-145.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata

Arkei Stealer Payload 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/3000-238-0x00000000006C0000-0x00000000006E1000-memory.dmp	family_arkei
behavioral2/memory/3000-241-0x0000000000400000-0x0000000000444000-memory.dmp	family_arkei

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/3488-280-0x00000000041C0000-0x0000000004295000-memory.dmp	family_vidar
behavioral2/memory/3488-288-0x0000000000400000-0x0000000002414000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 18 IoCs

pid	Process
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
3728	Sdz73eVmeqspWiIK3o6_GVYB.exe
1808	mrY3mEmWbzCVS6PyN7mU9YGx.exe
2780	HB3jh2ivHyd5l5VCGCAB0vJ3.exe
2788	BAlyHWnFgFt9vpibkynL8W7L.exe
3488	ZUeCd0P4JuDiGhRk8NfSuHo4.exe
3716	vL9v5iQXRoAh0Y355N5JpD9h.exe
1416	Z79pYAmlq91rRW1LQyyufBMU.exe
1488	sWrv6ZjgxAdtK5tWFGC3alm5.exe
364	meQg9sqq7LquWTajbgw6I9MF.exe
1352	h_xvSk43UTQEebhl9ZgiomFo.exe
3020	q5TqcV6K4Wk5eXMx2VeLcFE_.exe
3392	ALwMP6reJkYSo9FlLiy7F0GY.exe
2924	tsOf_aHrdIoJ1RPqT62PVMn6.exe
3000	NoTraN66A9YefchhqPSk_wCh.exe
3032	BkdEfJqG8LZP31Rd4QtT1iy6.exe
1752	BohwWeQSpbE3SycNBgycRutX.exe
3572	Pz5hAWxe_dVfvAaXtr67PBB5.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\International\Geo\Nation	9a60ffe0827afc57455926459836281f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000400000001ac0d-156.dat	themida
behavioral2/files/0x000400000001ac11-174.dat	themida
behavioral2/memory/3020-219-0x0000000000030000-0x0000000000031000-memory.dmp	themida
behavioral2/memory/3572-218-0x0000000000FE0000-0x0000000000FE1000-memory.dmp	themida
behavioral2/files/0x000400000001ac4a-313.dat	themida
behavioral2/files/0x000600000001ac49-324.dat	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Pz5hAWxe_dVfvAaXtr67PBB5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 15 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
194	ipinfo.io
289	ip-api.com
359	ip-api.com
140	ip-api.com
160	freegeoip.app
154	freegeoip.app
170	freegeoip.app
296	ipinfo.io
24	ipinfo.io
115	ipinfo.io
116	ipinfo.io
158	freegeoip.app
195	ipinfo.io
295	ipinfo.io
23	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3572	Pz5hAWxe_dVfvAaXtr67PBB5.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	RegAsm.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	RegAsm.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst2.exe	RegAsm.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	RegAsm.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
1472	1752	WerFault.exe	87
4120	1488	WerFault.exe	78
4304	1488	WerFault.exe	78
4860	1488	WerFault.exe	78
2212	1488	WerFault.exe	78
4640	1488	WerFault.exe	78
5656	4316	WerFault.exe	143
5880	4316	WerFault.exe	143
6056	4316	WerFault.exe	143
5292	4316	WerFault.exe	143
3936	4316	WerFault.exe	143

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2588	schtasks.exe
3672	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5072	timeout.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
4500	taskkill.exe
4600	taskkill.exe
5280	taskkill.exe
5960	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	9a60ffe0827afc57455926459836281f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c0000000100000004000000000800000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	9a60ffe0827afc57455926459836281f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3760	9a60ffe0827afc57455926459836281f.exe
3760	9a60ffe0827afc57455926459836281f.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe
1004	mE1zfjS_l3i2NfSM5TPwoA8j.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeAssignPrimaryTokenPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeLockMemoryPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeIncreaseQuotaPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeMachineAccountPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeTcbPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeSecurityPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeTakeOwnershipPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeLoadDriverPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeSystemProfilePrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeSystemtimePrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeProfSingleProcessPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeIncBasePriorityPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeCreatePagefilePrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeCreatePermanentPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeBackupPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeRestorePrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeShutdownPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeDebugPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeAuditPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeSystemEnvironmentPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeChangeNotifyPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeRemoteShutdownPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeUndockPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeSyncAgentPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeEnableDelegationPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeManageVolumePrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeImpersonatePrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeCreateGlobalPrivilege	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: 31	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: 32	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: 33	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: 34	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: 35	364	meQg9sqq7LquWTajbgw6I9MF.exe
Token: SeDebugPrivilege	2780	HB3jh2ivHyd5l5VCGCAB0vJ3.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 1004	3760	9a60ffe0827afc57455926459836281f.exe	69
PID 3760 wrote to memory of 1004	3760	9a60ffe0827afc57455926459836281f.exe	69
PID 3760 wrote to memory of 1808	3760	9a60ffe0827afc57455926459836281f.exe	71
PID 3760 wrote to memory of 1808	3760	9a60ffe0827afc57455926459836281f.exe	71
PID 3760 wrote to memory of 1808	3760	9a60ffe0827afc57455926459836281f.exe	71
PID 3760 wrote to memory of 3728	3760	9a60ffe0827afc57455926459836281f.exe	70
PID 3760 wrote to memory of 3728	3760	9a60ffe0827afc57455926459836281f.exe	70
PID 3760 wrote to memory of 3728	3760	9a60ffe0827afc57455926459836281f.exe	70
PID 3760 wrote to memory of 2780	3760	9a60ffe0827afc57455926459836281f.exe	75
PID 3760 wrote to memory of 2780	3760	9a60ffe0827afc57455926459836281f.exe	75
PID 3760 wrote to memory of 2780	3760	9a60ffe0827afc57455926459836281f.exe	75
PID 3760 wrote to memory of 2788	3760	9a60ffe0827afc57455926459836281f.exe	76
PID 3760 wrote to memory of 2788	3760	9a60ffe0827afc57455926459836281f.exe	76
PID 3760 wrote to memory of 2788	3760	9a60ffe0827afc57455926459836281f.exe	76
PID 3760 wrote to memory of 3488	3760	9a60ffe0827afc57455926459836281f.exe	74
PID 3760 wrote to memory of 3488	3760	9a60ffe0827afc57455926459836281f.exe	74
PID 3760 wrote to memory of 3488	3760	9a60ffe0827afc57455926459836281f.exe	74
PID 3760 wrote to memory of 3716	3760	9a60ffe0827afc57455926459836281f.exe	72
PID 3760 wrote to memory of 3716	3760	9a60ffe0827afc57455926459836281f.exe	72
PID 3760 wrote to memory of 3716	3760	9a60ffe0827afc57455926459836281f.exe	72
PID 3760 wrote to memory of 1416	3760	9a60ffe0827afc57455926459836281f.exe	73
PID 3760 wrote to memory of 1416	3760	9a60ffe0827afc57455926459836281f.exe	73
PID 3760 wrote to memory of 1416	3760	9a60ffe0827afc57455926459836281f.exe	73
PID 3760 wrote to memory of 1488	3760	9a60ffe0827afc57455926459836281f.exe	78
PID 3760 wrote to memory of 1488	3760	9a60ffe0827afc57455926459836281f.exe	78
PID 3760 wrote to memory of 1488	3760	9a60ffe0827afc57455926459836281f.exe	78
PID 3760 wrote to memory of 364	3760	9a60ffe0827afc57455926459836281f.exe	80
PID 3760 wrote to memory of 364	3760	9a60ffe0827afc57455926459836281f.exe	80
PID 3760 wrote to memory of 364	3760	9a60ffe0827afc57455926459836281f.exe	80
PID 3760 wrote to memory of 1352	3760	9a60ffe0827afc57455926459836281f.exe	79
PID 3760 wrote to memory of 1352	3760	9a60ffe0827afc57455926459836281f.exe	79
PID 3760 wrote to memory of 1352	3760	9a60ffe0827afc57455926459836281f.exe	79
PID 3760 wrote to memory of 3392	3760	9a60ffe0827afc57455926459836281f.exe	83
PID 3760 wrote to memory of 3392	3760	9a60ffe0827afc57455926459836281f.exe	83
PID 3760 wrote to memory of 3392	3760	9a60ffe0827afc57455926459836281f.exe	83
PID 3760 wrote to memory of 3020	3760	9a60ffe0827afc57455926459836281f.exe	82
PID 3760 wrote to memory of 3020	3760	9a60ffe0827afc57455926459836281f.exe	82
PID 3760 wrote to memory of 3020	3760	9a60ffe0827afc57455926459836281f.exe	82
PID 3760 wrote to memory of 2924	3760	9a60ffe0827afc57455926459836281f.exe	81
PID 3760 wrote to memory of 2924	3760	9a60ffe0827afc57455926459836281f.exe	81
PID 3760 wrote to memory of 2924	3760	9a60ffe0827afc57455926459836281f.exe	81
PID 3760 wrote to memory of 3000	3760	9a60ffe0827afc57455926459836281f.exe	86
PID 3760 wrote to memory of 3000	3760	9a60ffe0827afc57455926459836281f.exe	86
PID 3760 wrote to memory of 3000	3760	9a60ffe0827afc57455926459836281f.exe	86
PID 3760 wrote to memory of 3032	3760	9a60ffe0827afc57455926459836281f.exe	85
PID 3760 wrote to memory of 3032	3760	9a60ffe0827afc57455926459836281f.exe	85
PID 3760 wrote to memory of 3572	3760	9a60ffe0827afc57455926459836281f.exe	88
PID 3760 wrote to memory of 3572	3760	9a60ffe0827afc57455926459836281f.exe	88
PID 3760 wrote to memory of 3572	3760	9a60ffe0827afc57455926459836281f.exe	88
PID 3760 wrote to memory of 1752	3760	9a60ffe0827afc57455926459836281f.exe	87
PID 3760 wrote to memory of 1752	3760	9a60ffe0827afc57455926459836281f.exe	87
PID 3760 wrote to memory of 1752	3760	9a60ffe0827afc57455926459836281f.exe	87

C:\Users\Admin\AppData\Local\Temp\9a60ffe0827afc57455926459836281f.exe
"C:\Users\Admin\AppData\Local\Temp\9a60ffe0827afc57455926459836281f.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\Pictures\Adobe Films\mE1zfjS_l3i2NfSM5TPwoA8j.exe
  "C:\Users\Admin\Pictures\Adobe Films\mE1zfjS_l3i2NfSM5TPwoA8j.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Users\Admin\Pictures\Adobe Films\Sdz73eVmeqspWiIK3o6_GVYB.exe
  "C:\Users\Admin\Pictures\Adobe Films\Sdz73eVmeqspWiIK3o6_GVYB.exe"
  2⤵
  - Executes dropped EXE
  PID:3728
- - C:\Users\Admin\Documents\DsWVBLGEcfIMqjixcq6DN6dU.exe
    "C:\Users\Admin\Documents\DsWVBLGEcfIMqjixcq6DN6dU.exe"
    3⤵
    PID:3532
  - - C:\Users\Admin\Pictures\Adobe Films\Hac9A6ak2tarclHbQcuWGPo9.exe
      "C:\Users\Admin\Pictures\Adobe Films\Hac9A6ak2tarclHbQcuWGPo9.exe"
      4⤵
      PID:2280
  - - C:\Users\Admin\Pictures\Adobe Films\VApW6yY_2OXOw8Ev7TdEvwQS.exe
      "C:\Users\Admin\Pictures\Adobe Films\VApW6yY_2OXOw8Ev7TdEvwQS.exe"
      4⤵
      PID:4316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 656
        5⤵
        Program crash
        
        PID:5656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 672
        5⤵
        Program crash
        
        PID:5880
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 772
        5⤵
        Program crash
        
        PID:6056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 808
        5⤵
        Program crash
        
        PID:5292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 756
        5⤵
        Program crash
        
        PID:3936
  - - C:\Users\Admin\Pictures\Adobe Films\2nO3hJWWx2KtHctYFuPdXC3C.exe
      "C:\Users\Admin\Pictures\Adobe Films\2nO3hJWWx2KtHctYFuPdXC3C.exe"
      4⤵
      PID:4280
  - - C:\Users\Admin\Pictures\Adobe Films\rupou9irEaYzZO7_nwDG5CN9.exe
      "C:\Users\Admin\Pictures\Adobe Films\rupou9irEaYzZO7_nwDG5CN9.exe"
      4⤵
      PID:1532
  - - C:\Users\Admin\Pictures\Adobe Films\UC7Ildif7JzpsLNxe43csSCQ.exe
      "C:\Users\Admin\Pictures\Adobe Films\UC7Ildif7JzpsLNxe43csSCQ.exe"
      4⤵
      PID:4964
  - - C:\Users\Admin\Pictures\Adobe Films\WbpeYbeN2wINmEAB2KmW6u6i.exe
      "C:\Users\Admin\Pictures\Adobe Films\WbpeYbeN2wINmEAB2KmW6u6i.exe"
      4⤵
      PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\is-1SFC1.tmp\WbpeYbeN2wINmEAB2KmW6u6i.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-1SFC1.tmp\WbpeYbeN2wINmEAB2KmW6u6i.tmp" /SL5="$202DE,506127,422400,C:\Users\Admin\Pictures\Adobe Films\WbpeYbeN2wINmEAB2KmW6u6i.exe"
        5⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\is-R7GQI.tmp\lakazet.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-R7GQI.tmp\lakazet.exe" /S /UID=2709
        6⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\ae-8d587-bf3-97a9b-1af494871648a\Pucocapiwu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ae-8d587-bf3-97a9b-1af494871648a\Pucocapiwu.exe"
        7⤵
        
        PID:5996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0skx4dsr.sk5\installer.exe /qn CAMPAIGN="654" & exit
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\0skx4dsr.sk5\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\0skx4dsr.sk5\installer.exe /qn CAMPAIGN="654"
        9⤵
        
        PID:7088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ynkedm51.3ej\any.exe & exit
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\ynkedm51.3ej\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\ynkedm51.3ej\any.exe
        9⤵
        
        PID:5636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mith4nzx.wt3\autosubplayer.exe /S & exit
        8⤵
        
        PID:7052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0sucvnf2.l0v\installer.exe /qn CAMPAIGN=654 & exit
        8⤵
        
        PID:5728
  - - C:\Users\Admin\Pictures\Adobe Films\fmivrEfLM1aFltG_VA8ofV5d.exe
      "C:\Users\Admin\Pictures\Adobe Films\fmivrEfLM1aFltG_VA8ofV5d.exe"
      4⤵
      PID:5048
    - - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        5⤵
        
        PID:4564
  - - C:\Users\Admin\Pictures\Adobe Films\Qeo3S36zactjWN8JUfw5Qqna.exe
      "C:\Users\Admin\Pictures\Adobe Films\Qeo3S36zactjWN8JUfw5Qqna.exe"
      4⤵
      PID:4920
    - - C:\Users\Admin\Pictures\Adobe Films\Qeo3S36zactjWN8JUfw5Qqna.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Qeo3S36zactjWN8JUfw5Qqna.exe" -u
        5⤵
        
        PID:2952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3672
- C:\Users\Admin\Pictures\Adobe Films\mrY3mEmWbzCVS6PyN7mU9YGx.exe
  "C:\Users\Admin\Pictures\Adobe Films\mrY3mEmWbzCVS6PyN7mU9YGx.exe"
  2⤵
  - Executes dropped EXE
  PID:1808
- - C:\Users\Admin\Pictures\Adobe Films\mrY3mEmWbzCVS6PyN7mU9YGx.exe
    "C:\Users\Admin\Pictures\Adobe Films\mrY3mEmWbzCVS6PyN7mU9YGx.exe"
    3⤵
    PID:820
- C:\Users\Admin\Pictures\Adobe Films\vL9v5iQXRoAh0Y355N5JpD9h.exe
  "C:\Users\Admin\Pictures\Adobe Films\vL9v5iQXRoAh0Y355N5JpD9h.exe"
  2⤵
  - Executes dropped EXE
  PID:3716
- - C:\Users\Admin\Pictures\Adobe Films\vL9v5iQXRoAh0Y355N5JpD9h.exe
    "C:\Users\Admin\Pictures\Adobe Films\vL9v5iQXRoAh0Y355N5JpD9h.exe"
    3⤵
    PID:688
- C:\Users\Admin\Pictures\Adobe Films\Z79pYAmlq91rRW1LQyyufBMU.exe
  "C:\Users\Admin\Pictures\Adobe Films\Z79pYAmlq91rRW1LQyyufBMU.exe"
  2⤵
  - Executes dropped EXE
  PID:1416
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Drops file in Program Files directory
    PID:1352
- C:\Users\Admin\Pictures\Adobe Films\ZUeCd0P4JuDiGhRk8NfSuHo4.exe
  "C:\Users\Admin\Pictures\Adobe Films\ZUeCd0P4JuDiGhRk8NfSuHo4.exe"
  2⤵
  - Executes dropped EXE
  PID:3488
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im ZUeCd0P4JuDiGhRk8NfSuHo4.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\ZUeCd0P4JuDiGhRk8NfSuHo4.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:1872
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im ZUeCd0P4JuDiGhRk8NfSuHo4.exe /f
      4⤵
      Kills process with taskkill
      PID:5280
- C:\Users\Admin\Pictures\Adobe Films\HB3jh2ivHyd5l5VCGCAB0vJ3.exe
  "C:\Users\Admin\Pictures\Adobe Films\HB3jh2ivHyd5l5VCGCAB0vJ3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Users\Admin\Pictures\Adobe Films\BAlyHWnFgFt9vpibkynL8W7L.exe
  "C:\Users\Admin\Pictures\Adobe Films\BAlyHWnFgFt9vpibkynL8W7L.exe"
  2⤵
  - Executes dropped EXE
  PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\5898683845.exe"
    3⤵
    PID:672
  - - C:\Users\Admin\AppData\Local\Temp\5898683845.exe
      "C:\Users\Admin\AppData\Local\Temp\5898683845.exe"
      4⤵
      PID:1140
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im 5898683845.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\5898683845.exe" & del C:\ProgramData\*.dll & exit
        5⤵
        
        PID:6984
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im 5898683845.exe /f
        6⤵
        Kills process with taskkill
        
        PID:5960
- C:\Users\Admin\Pictures\Adobe Films\sWrv6ZjgxAdtK5tWFGC3alm5.exe
  "C:\Users\Admin\Pictures\Adobe Films\sWrv6ZjgxAdtK5tWFGC3alm5.exe"
  2⤵
  - Executes dropped EXE
  PID:1488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 664
    3⤵
    - Program crash
    PID:4120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 680
    3⤵
    - Program crash
    PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 640
    3⤵
    - Program crash
    PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 696
    3⤵
    - Program crash
    PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 792
    3⤵
    - Program crash
    PID:4640
- C:\Users\Admin\Pictures\Adobe Films\h_xvSk43UTQEebhl9ZgiomFo.exe
  "C:\Users\Admin\Pictures\Adobe Films\h_xvSk43UTQEebhl9ZgiomFo.exe"
  2⤵
  - Executes dropped EXE
  PID:1352
- - C:\Program Files (x86)\Company\NewProduct\inst2.exe
    "C:\Program Files (x86)\Company\NewProduct\inst2.exe"
    3⤵
    PID:3836
- - C:\Program Files (x86)\Company\NewProduct\cm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cm3.exe"
    3⤵
    PID:2884
- - C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe
    "C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"
    3⤵
    PID:648
- C:\Users\Admin\Pictures\Adobe Films\meQg9sqq7LquWTajbgw6I9MF.exe
  "C:\Users\Admin\Pictures\Adobe Films\meQg9sqq7LquWTajbgw6I9MF.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:364
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c taskkill /f /im chrome.exe
    3⤵
    PID:5104
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      PID:4500
- C:\Users\Admin\Pictures\Adobe Films\tsOf_aHrdIoJ1RPqT62PVMn6.exe
  "C:\Users\Admin\Pictures\Adobe Films\tsOf_aHrdIoJ1RPqT62PVMn6.exe"
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Users\Admin\Pictures\Adobe Films\q5TqcV6K4Wk5eXMx2VeLcFE_.exe
  "C:\Users\Admin\Pictures\Adobe Films\q5TqcV6K4Wk5eXMx2VeLcFE_.exe"
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Users\Admin\Pictures\Adobe Films\ALwMP6reJkYSo9FlLiy7F0GY.exe
  "C:\Users\Admin\Pictures\Adobe Films\ALwMP6reJkYSo9FlLiy7F0GY.exe"
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Users\Admin\Pictures\Adobe Films\BkdEfJqG8LZP31Rd4QtT1iy6.exe
  "C:\Users\Admin\Pictures\Adobe Films\BkdEfJqG8LZP31Rd4QtT1iy6.exe"
  2⤵
  - Executes dropped EXE
  PID:3032
- - C:\Users\Admin\AppData\Roaming\8868246.exe
    "C:\Users\Admin\AppData\Roaming\8868246.exe"
    3⤵
    PID:4188
- - C:\Users\Admin\AppData\Roaming\2388654.exe
    "C:\Users\Admin\AppData\Roaming\2388654.exe"
    3⤵
    PID:4236
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:4584
- - C:\Users\Admin\AppData\Roaming\2486361.exe
    "C:\Users\Admin\AppData\Roaming\2486361.exe"
    3⤵
    PID:4428
- - C:\Users\Admin\AppData\Roaming\2241638.exe
    "C:\Users\Admin\AppData\Roaming\2241638.exe"
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Roaming\516612.exe
    "C:\Users\Admin\AppData\Roaming\516612.exe"
    3⤵
    PID:4912
  - - C:\Users\Admin\AppData\Roaming\409341.exe
      "C:\Users\Admin\AppData\Roaming\409341.exe"
      4⤵
      PID:4508
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbscriPT: clOse ( cREATEoBjECt ( "WSCrIpT.SHELL" ).RUn ( "cmD /R copY /y ""C:\Users\Admin\AppData\Roaming\409341.exe"" ..\BAonQORGWTA.ExE && StARt ..\BAOnQORGWtA.eXe -Pujx~7oph_rahzkCkBiIXQg~Q3fiHhH & IF """" == """" for %q In (""C:\Users\Admin\AppData\Roaming\409341.exe"" ) do taskkill -F /iM ""%~NXq"" " , 0, trUE) )
        5⤵
        
        PID:4528
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R copY /y "C:\Users\Admin\AppData\Roaming\409341.exe" ..\BAonQORGWTA.ExE && StARt ..\BAOnQORGWtA.eXe -Pujx~7oph_rahzkCkBiIXQg~Q3fiHhH& IF "" == "" for %q In ("C:\Users\Admin\AppData\Roaming\409341.exe" ) do taskkill -F /iM "%~NXq"
        6⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\BAonQORGWTA.ExE
        
        ..\BAOnQORGWtA.eXe -Pujx~7oph_rahzkCkBiIXQg~Q3fiHhH
        7⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbscriPT: clOse ( cREATEoBjECt ( "WSCrIpT.SHELL" ).RUn ( "cmD /R copY /y ""C:\Users\Admin\AppData\Local\Temp\BAonQORGWTA.ExE"" ..\BAonQORGWTA.ExE && StARt ..\BAOnQORGWtA.eXe -Pujx~7oph_rahzkCkBiIXQg~Q3fiHhH & IF ""-Pujx~7oph_rahzkCkBiIXQg~Q3fiHhH"" == """" for %q In (""C:\Users\Admin\AppData\Local\Temp\BAonQORGWTA.ExE"" ) do taskkill -F /iM ""%~NXq"" " , 0, trUE) )
        8⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R copY /y "C:\Users\Admin\AppData\Local\Temp\BAonQORGWTA.ExE" ..\BAonQORGWTA.ExE && StARt ..\BAOnQORGWtA.eXe -Pujx~7oph_rahzkCkBiIXQg~Q3fiHhH& IF "-Pujx~7oph_rahzkCkBiIXQg~Q3fiHhH" == "" for %q In ("C:\Users\Admin\AppData\Local\Temp\BAonQORGWTA.ExE" ) do taskkill -F /iM "%~NXq"
        9⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIpt: ClOSE(CReateoBjEct ("wscripT.shELl" ). RUN ("C:\Windows\system32\cmd.exe /q /R eCHO TVe%tIme%W95l> N7PwONGL.9 & eCHO | set /P = ""MZ"" > URUHH.m & CoPY /B /Y URUHH.M + y0HgNKNY.W + kYs2.FQY+ PKH4qG.T + WRKeBB.GqD + dcjSzYm.V + N7PWONgL.9 ..\UAMbZ5ai.GwU & stART control.exe ..\UAMBZ5Ai.GWU & del /Q * " ,0, true ) )
        8⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /R eCHO TVe%tIme%W95l> N7PwONGL.9 & eCHO | set /P = "MZ" > URUHH.m & CoPY /B /Y URUHH.M + y0HgNKNY.W+ kYs2.FQY+ PKH4qG.T +WRKeBB.GqD + dcjSzYm.V+ N7PWONgL.9 ..\UAMbZ5ai.GwU& stART control.exe ..\UAMBZ5Ai.GWU & del /Q *
        9⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        10⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>URUHH.m"
        10⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\control.exe
        
        control.exe ..\UAMBZ5Ai.GWU
        10⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\UAMBZ5Ai.GWU
        11⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F /iM "409341.exe"
        7⤵
        Kills process with taskkill
        
        PID:4600
  - - C:\Users\Admin\AppData\Roaming\8399624.exe
      "C:\Users\Admin\AppData\Roaming\8399624.exe"
      4⤵
      PID:2336
- - C:\Users\Admin\AppData\Roaming\4839693.exe
    "C:\Users\Admin\AppData\Roaming\4839693.exe"
    3⤵
    PID:4832
- - C:\Users\Admin\AppData\Roaming\6026172.exe
    "C:\Users\Admin\AppData\Roaming\6026172.exe"
    3⤵
    PID:4576
- C:\Users\Admin\Pictures\Adobe Films\NoTraN66A9YefchhqPSk_wCh.exe
  "C:\Users\Admin\Pictures\Adobe Films\NoTraN66A9YefchhqPSk_wCh.exe"
  2⤵
  - Executes dropped EXE
  PID:3000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\NoTraN66A9YefchhqPSk_wCh.exe" & exit
    3⤵
    PID:1400
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5072
- C:\Users\Admin\Pictures\Adobe Films\BohwWeQSpbE3SycNBgycRutX.exe
  "C:\Users\Admin\Pictures\Adobe Films\BohwWeQSpbE3SycNBgycRutX.exe"
  2⤵
  - Executes dropped EXE
  PID:1752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 400
    3⤵
    - Program crash
    PID:1472
- C:\Users\Admin\Pictures\Adobe Films\Pz5hAWxe_dVfvAaXtr67PBB5.exe
  "C:\Users\Admin\Pictures\Adobe Films\Pz5hAWxe_dVfvAaXtr67PBB5.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3572
- C:\Users\Admin\Pictures\Adobe Films\oO4VVRSWfJWSRvKEjatX_RRq.exe
  "C:\Users\Admin\Pictures\Adobe Films\oO4VVRSWfJWSRvKEjatX_RRq.exe"
  2⤵
  PID:4396
- - C:\Users\Admin\AppData\Local\Temp\is-ETJFV.tmp\oO4VVRSWfJWSRvKEjatX_RRq.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-ETJFV.tmp\oO4VVRSWfJWSRvKEjatX_RRq.tmp" /SL5="$90058,506127,422400,C:\Users\Admin\Pictures\Adobe Films\oO4VVRSWfJWSRvKEjatX_RRq.exe"
    3⤵
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\is-9D1EP.tmp\lakazet.exe
      "C:\Users\Admin\AppData\Local\Temp\is-9D1EP.tmp\lakazet.exe" /S /UID=2709
      4⤵
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\8b-f5f42-ba8-058a3-1efb527c7845f\Jaenaekatidu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8b-f5f42-ba8-058a3-1efb527c7845f\Jaenaekatidu.exe"
        5⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\3a-16552-906-d32a2-5dec96faa81a6\Kilaekaculy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3a-16552-906-d32a2-5dec96faa81a6\Kilaekaculy.exe"
        5⤵
        
        PID:4436
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ezcst1or.ezv\GcleanerEU.exe /eufive & exit
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\ezcst1or.ezv\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\ezcst1or.ezv\GcleanerEU.exe /eufive
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\ezcst1or.ezv\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\ezcst1or.ezv\GcleanerEU.exe /eufive
        8⤵
        
        PID:5884
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\quao5o5v.4h4\installer.exe /qn CAMPAIGN="654" & exit
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\quao5o5v.4h4\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\quao5o5v.4h4\installer.exe /qn CAMPAIGN="654"
        7⤵
        
        PID:5688
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jtsi4aw2.k0t\vpn.exe /silent /subid=798 & exit
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\jtsi4aw2.k0t\vpn.exe
        
        C:\Users\Admin\AppData\Local\Temp\jtsi4aw2.k0t\vpn.exe /silent /subid=798
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\is-H9NUE.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-H9NUE.tmp\vpn.tmp" /SL5="$203C4,15170975,270336,C:\Users\Admin\AppData\Local\Temp\jtsi4aw2.k0t\vpn.exe" /silent /subid=798
        8⤵
        
        PID:2240
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mrmxr5mp.e1g\any.exe & exit
        6⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\mrmxr5mp.e1g\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\mrmxr5mp.e1g\any.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\mrmxr5mp.e1g\any.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mrmxr5mp.e1g\any.exe" -u
        8⤵
        
        PID:1756
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\odk4qywz.3jc\avb51.exe & exit
        6⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\odk4qywz.3jc\avb51.exe
        
        C:\Users\Admin\AppData\Local\Temp\odk4qywz.3jc\avb51.exe
        7⤵
        
        PID:4668
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4l2uj44c.ww5\gcleaner.exe /mixfive & exit
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\4l2uj44c.ww5\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\4l2uj44c.ww5\gcleaner.exe /mixfive
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\4l2uj44c.ww5\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\4l2uj44c.ww5\gcleaner.exe /mixfive
        8⤵
        
        PID:5920
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ep32os2d.s23\autosubplayer.exe /S & exit
        6⤵
        
        PID:6888
    - - C:\Program Files\Microsoft Office\PTBQZRRRAW\foldershare.exe
        
        "C:\Program Files\Microsoft Office\PTBQZRRRAW\foldershare.exe" /VERYSILENT
        5⤵
        
        PID:3916
- C:\Users\Admin\Pictures\Adobe Films\7lfNV8lICkn9_jO7ShR6r8S2.exe
  "C:\Users\Admin\Pictures\Adobe Films\7lfNV8lICkn9_jO7ShR6r8S2.exe"
  2⤵
  PID:4496

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5228

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-242-0x0000000000030000-0x0000000000033000-memory.dmp

Download

memory/688-254-0x0000000005420000-0x0000000005A26000-memory.dmp

Download

memory/688-243-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/820-260-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/820-263-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1140-271-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/1340-461-0x0000000000530000-0x0000000000532000-memory.dmp

Download

memory/1352-417-0x00000000051B0000-0x00000000057B6000-memory.dmp

Download

memory/1416-229-0x0000000004E10000-0x000000000530E000-memory.dmp

Download

memory/1416-171-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Download

memory/1416-164-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/1416-185-0x0000000004E10000-0x000000000530E000-memory.dmp

Download

memory/1416-196-0x0000000005960000-0x0000000005961000-memory.dmp

Download

memory/1416-151-0x0000000000610000-0x0000000000611000-memory.dmp

Download

memory/1416-176-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/1488-290-0x0000000003FB0000-0x0000000003FF4000-memory.dmp

Download

memory/1488-293-0x0000000000400000-0x00000000023BF000-memory.dmp

Download

memory/1488-286-0x0000000002528000-0x0000000002550000-memory.dmp

Download

memory/1752-183-0x0000000000B50000-0x0000000000C9A000-memory.dmp

Download

memory/1808-259-0x00000000001E0000-0x00000000001E6000-memory.dmp

Download

memory/2008-471-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/2780-225-0x0000000002392000-0x0000000002393000-memory.dmp

Download

memory/2780-184-0x0000000004F20000-0x0000000004F4C000-memory.dmp

Download

memory/2780-190-0x0000000002060000-0x0000000002099000-memory.dmp

Download

memory/2780-192-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download

memory/2780-207-0x0000000002394000-0x0000000002396000-memory.dmp

Download

memory/2780-217-0x00000000057A0000-0x00000000057A1000-memory.dmp

Download

memory/2780-220-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2780-189-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/2780-180-0x0000000002330000-0x000000000235E000-memory.dmp

Download

memory/2780-197-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/2780-264-0x0000000005A30000-0x0000000005A31000-memory.dmp

Download

memory/2780-188-0x0000000002030000-0x000000000205B000-memory.dmp

Download

memory/2780-206-0x0000000005710000-0x0000000005711000-memory.dmp

Download

memory/2780-223-0x0000000002390000-0x0000000002391000-memory.dmp

Download

memory/2780-226-0x0000000002393000-0x0000000002394000-memory.dmp

Download

memory/2924-276-0x0000000004597000-0x00000000049A6000-memory.dmp

Download

memory/2924-291-0x00000000049B0000-0x0000000005252000-memory.dmp

Download

memory/2924-289-0x0000000000400000-0x00000000027A8000-memory.dmp

Download

memory/3000-232-0x0000000000450000-0x000000000059A000-memory.dmp

Download

memory/3000-238-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/3000-241-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3020-195-0x0000000077610000-0x000000007779E000-memory.dmp

Download

memory/3020-237-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/3020-219-0x0000000000030000-0x0000000000031000-memory.dmp

Download

memory/3032-213-0x000000001AD30000-0x000000001AD32000-memory.dmp

Download

memory/3032-205-0x0000000001EF0000-0x0000000001EFE000-memory.dmp

Download

memory/3032-178-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/3392-282-0x0000000002E20000-0x0000000002EAF000-memory.dmp

Download

memory/3392-292-0x0000000000400000-0x0000000002B85000-memory.dmp

Download

memory/3392-278-0x0000000002F06000-0x0000000002F56000-memory.dmp

Download

memory/3488-280-0x00000000041C0000-0x0000000004295000-memory.dmp

Download

memory/3488-288-0x0000000000400000-0x0000000002414000-memory.dmp

Download

memory/3532-421-0x0000000008480000-0x00000000085CC000-memory.dmp

Download

memory/3572-218-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/3572-234-0x0000000005D40000-0x0000000005D41000-memory.dmp

Download

memory/3572-193-0x0000000077610000-0x000000007779E000-memory.dmp

Download

memory/3716-175-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/3716-179-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/3716-186-0x0000000002700000-0x0000000002701000-memory.dmp

Download

memory/3716-187-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Download

memory/3760-118-0x0000000007B20000-0x0000000007C6C000-memory.dmp

Download

memory/3836-201-0x00000000001E0000-0x00000000001F0000-memory.dmp

Download

memory/3836-216-0x0000000000440000-0x000000000058A000-memory.dmp

Download

memory/3916-480-0x0000000001060000-0x0000000001062000-memory.dmp

Download

memory/3916-483-0x0000000001062000-0x0000000001064000-memory.dmp

Download

memory/3916-485-0x0000000001064000-0x0000000001065000-memory.dmp

Download

memory/3916-486-0x0000000001065000-0x0000000001066000-memory.dmp

Download

memory/3924-484-0x0000000002A10000-0x0000000002A12000-memory.dmp

Download

memory/4188-304-0x0000000002540000-0x0000000002541000-memory.dmp

Download

memory/4188-317-0x0000000004B30000-0x0000000004B31000-memory.dmp

Download

memory/4188-298-0x0000000000310000-0x0000000000311000-memory.dmp

Download

memory/4188-306-0x0000000004B00000-0x0000000004B2E000-memory.dmp

Download

memory/4236-305-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Download

memory/4236-302-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/4280-478-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4280-475-0x0000000000670000-0x0000000000679000-memory.dmp

Download

memory/4280-473-0x0000000000660000-0x0000000000668000-memory.dmp

Download

memory/4396-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4428-337-0x0000000077610000-0x000000007779E000-memory.dmp

Download

memory/4428-361-0x0000000005790000-0x0000000005791000-memory.dmp

Download

memory/4436-479-0x00000000027A0000-0x00000000027A2000-memory.dmp

Download

memory/4436-481-0x00000000027A2000-0x00000000027A4000-memory.dmp

Download

memory/4436-482-0x00000000027A4000-0x00000000027A5000-memory.dmp

Download

memory/4516-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4540-341-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/4576-345-0x0000000077610000-0x000000007779E000-memory.dmp

Download

memory/4576-415-0x0000000005770000-0x0000000005771000-memory.dmp

Download

memory/4584-365-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Download

memory/4832-413-0x00000000058E0000-0x00000000058E1000-memory.dmp

Download

memory/4832-383-0x0000000077610000-0x000000007779E000-memory.dmp

Download

memory/4912-387-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Download

memory/4972-397-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/5112-392-0x0000000000930000-0x0000000000932000-memory.dmp

Download