Analysis
-
max time kernel
116s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
23/11/2021, 16:32
Static task
static1
General
-
Target
77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe
-
Size
6.2MB
-
MD5
f4405d3dd08690d4ce4e9a02d4c641df
-
SHA1
26975067cc24f634f6c64a79b98f356fb639d77e
-
SHA256
77012c024869ba2639b54b959fab1e10ebaaf8ebb9bfcc2a11db4c71a2b9fa59
-
SHA512
992bd478eaa78efa74a16dc2338b0f9dccf6b91644b35631673aa038e174b6463b6845bbac80fbb14d27fdef8952331c3ce3ae92e14d46ce8cf9290939b3517f
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.znsjis.top/
Extracted
vidar
41
706
https://mas.to/@killern0
-
profile_id
706
Extracted
smokeloader
2020
http://govsurplusstore.com/upload/
http://best-forsale.com/upload/
http://chmxnautoparts.com/upload/
http://kwazone.com/upload/
Extracted
redline
ANI
45.142.215.47:27643
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
resource yara_rule behavioral1/memory/2480-231-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/2480-233-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/2480-234-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/2480-236-0x000000000041C5CA-mapping.dmp family_redline behavioral1/memory/2480-238-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/2568-240-0x0000000000D90000-0x0000000000EAE000-memory.dmp family_redline behavioral1/memory/2544-247-0x000000000041C5FA-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 5 IoCs
resource yara_rule behavioral1/files/0x000500000001300a-119.dat family_socelars behavioral1/files/0x000500000001300a-160.dat family_socelars behavioral1/files/0x000500000001300a-167.dat family_socelars behavioral1/files/0x000500000001300a-173.dat family_socelars behavioral1/files/0x000500000001300a-172.dat family_socelars -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral1/memory/2032-215-0x0000000000B10000-0x0000000000BE4000-memory.dmp family_vidar behavioral1/memory/2032-216-0x0000000000400000-0x000000000051E000-memory.dmp family_vidar -
resource yara_rule behavioral1/files/0x00050000000125f8-71.dat aspack_v212_v242 behavioral1/files/0x00050000000125f8-72.dat aspack_v212_v242 behavioral1/files/0x00050000000125f0-73.dat aspack_v212_v242 behavioral1/files/0x00050000000125f0-74.dat aspack_v212_v242 behavioral1/files/0x000500000001260d-77.dat aspack_v212_v242 behavioral1/files/0x000500000001260d-78.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 41 IoCs
pid Process 1076 setup_installer.exe 616 setup_install.exe 1728 Thu006994f743f.exe 588 Thu0024eb0c01ddf62.exe 1576 Thu008c1e505ef28ce.exe 1260 Thu00e6dc783f.exe 1164 Thu00baff0b12d.exe 1652 Thu00b87bb8a6c15.exe 1680 Thu000ee9073d9260.exe 2032 Thu00381dcd157d70.exe 1012 Thu0033b1bf632d.exe 984 Thu0046fa0086fb73b2f.exe 1188 Thu009182426214b9c.exe 1708 Thu00c42c363480.exe 2472 Thu009182426214b9c.exe 2480 Thu008c1e505ef28ce.exe 2544 Thu009182426214b9c.exe 2884 Thu00e1362251a3.exe 2872 LCyVfEeuSidwmRTOmtyMi8Uk.exe 3052 YT29JeOYKhsE8g3tCNxM34uZ.exe 3064 RjITuXzfKtugbKSf2mOAQ8s7.exe 2200 oLWRqC0rrYKixjpg2s7YHJNf.exe 1784 RNNpCdc3OwfgCA0YANUQ1Bo1.exe 756 bswUKV9V9ldFkYLi3yS_rNiw.exe 108 jxbgMEgt20UGvvp2NW60fsAP.exe 564 h2pq0QUifN7Ah156Vig9EsXx.exe 2252 hp0NVopuBF5fbIYTy0tbD4Fo.exe 2356 elIDM7ianDMh_oCzOB0avpRk.exe 2348 q2Rrer7OYcVBwhxn74Q3fIun.exe 2392 L9v8f0CPxFd3_JEl1zneAqbY.exe 2376 8EOaWd1Lfloa9X5pJ1e7H54c.exe 2336 u0ZEuYiy5a0j8hKqQ_zE7_xH.exe 2432 RVuz7j6lZmLr7A0ka5vwZtUJ.exe 2448 9Jausx51saNOkp40AA3ocW4J.exe 1696 GKNd8JjiwUe8OB5Upfx630dA.exe 2248 yoah0q_ZvLiATzh2UFN_Rgih.exe 2332 MhBanFF4yfhZOkMlA4rXJAA7.exe 1012 nKkemSjgDD3fWQSYxHPc0UrE.exe 2464 JUdzauA7JmWF7VvBGBNDjlxf.exe 1648 GQf7inFlzV_DW6wAotD1UjSI.exe 2456 g89ovLd5hnd9Bg25irx6gIjL.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Thu00baff0b12d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Thu00baff0b12d.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\International\Geo\Nation Thu00c42c363480.exe -
Loads dropped DLL 64 IoCs
pid Process 756 77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe 1076 setup_installer.exe 1076 setup_installer.exe 1076 setup_installer.exe 1076 setup_installer.exe 1076 setup_installer.exe 1076 setup_installer.exe 616 setup_install.exe 616 setup_install.exe 616 setup_install.exe 616 setup_install.exe 616 setup_install.exe 616 setup_install.exe 616 setup_install.exe 616 setup_install.exe 840 cmd.exe 1728 Thu006994f743f.exe 1728 Thu006994f743f.exe 1612 cmd.exe 1612 cmd.exe 1972 cmd.exe 1972 cmd.exe 588 Thu0024eb0c01ddf62.exe 588 Thu0024eb0c01ddf62.exe 1608 cmd.exe 1608 cmd.exe 328 cmd.exe 1716 cmd.exe 1652 Thu00b87bb8a6c15.exe 1652 Thu00b87bb8a6c15.exe 1576 Thu008c1e505ef28ce.exe 1576 Thu008c1e505ef28ce.exe 1740 cmd.exe 1164 Thu00baff0b12d.exe 1164 Thu00baff0b12d.exe 1724 cmd.exe 1724 cmd.exe 1904 cmd.exe 1904 cmd.exe 1080 cmd.exe 1128 cmd.exe 1128 cmd.exe 1928 cmd.exe 2032 Thu00381dcd157d70.exe 2032 Thu00381dcd157d70.exe 1012 Thu0033b1bf632d.exe 1012 Thu0033b1bf632d.exe 1708 Thu00c42c363480.exe 1708 Thu00c42c363480.exe 1188 Thu009182426214b9c.exe 1188 Thu009182426214b9c.exe 1460 WerFault.exe 1460 WerFault.exe 1460 WerFault.exe 1460 WerFault.exe 1188 Thu009182426214b9c.exe 1576 Thu008c1e505ef28ce.exe 1188 Thu009182426214b9c.exe 2568 WerFault.exe 2568 WerFault.exe 2568 WerFault.exe 2568 WerFault.exe 2568 WerFault.exe 2568 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x0005000000013043-127.dat themida behavioral1/files/0x0005000000013043-157.dat themida behavioral1/files/0x0005000000013043-163.dat themida behavioral1/files/0x0005000000013043-183.dat themida behavioral1/files/0x0005000000013043-182.dat themida behavioral1/memory/1164-210-0x00000000000E0000-0x00000000000E1000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Thu00baff0b12d.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 71 ip-api.com 223 ipinfo.io 224 ipinfo.io 62 ipinfo.io 63 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1164 Thu00baff0b12d.exe 108 jxbgMEgt20UGvvp2NW60fsAP.exe 2456 g89ovLd5hnd9Bg25irx6gIjL.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1576 set thread context of 2480 1576 Thu008c1e505ef28ce.exe 66 PID 1188 set thread context of 2544 1188 Thu009182426214b9c.exe 69 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
pid pid_target Process procid_target 1460 616 WerFault.exe 29 2568 2032 WerFault.exe 54 2776 2356 WerFault.exe 80 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Thu0033b1bf632d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Thu0033b1bf632d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Thu0033b1bf632d.exe -
Kills process with taskkill 2 IoCs
pid Process 2424 taskkill.exe 2996 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Thu00b87bb8a6c15.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Thu00b87bb8a6c15.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 Thu00c42c363480.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd Thu00c42c363480.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd Thu00c42c363480.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd Thu00c42c363480.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1164 Thu00baff0b12d.exe 1460 WerFault.exe 1460 WerFault.exe 1460 WerFault.exe 1460 WerFault.exe 1460 WerFault.exe 1460 WerFault.exe 1460 WerFault.exe 1012 Thu0033b1bf632d.exe 1012 Thu0033b1bf632d.exe 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1012 Thu0033b1bf632d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeAssignPrimaryTokenPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeLockMemoryPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeIncreaseQuotaPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeMachineAccountPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeTcbPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeSecurityPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeTakeOwnershipPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeLoadDriverPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeSystemProfilePrivilege 1652 Thu00b87bb8a6c15.exe Token: SeSystemtimePrivilege 1652 Thu00b87bb8a6c15.exe Token: SeProfSingleProcessPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeIncBasePriorityPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeCreatePagefilePrivilege 1652 Thu00b87bb8a6c15.exe Token: SeCreatePermanentPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeBackupPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeRestorePrivilege 1652 Thu00b87bb8a6c15.exe Token: SeShutdownPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeDebugPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeAuditPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeSystemEnvironmentPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeChangeNotifyPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeRemoteShutdownPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeUndockPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeSyncAgentPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeEnableDelegationPrivilege 1652 Thu00b87bb8a6c15.exe Token: SeManageVolumePrivilege 1652 Thu00b87bb8a6c15.exe Token: SeImpersonatePrivilege 1652 Thu00b87bb8a6c15.exe Token: SeCreateGlobalPrivilege 1652 Thu00b87bb8a6c15.exe Token: 31 1652 Thu00b87bb8a6c15.exe Token: 32 1652 Thu00b87bb8a6c15.exe Token: 33 1652 Thu00b87bb8a6c15.exe Token: 34 1652 Thu00b87bb8a6c15.exe Token: 35 1652 Thu00b87bb8a6c15.exe Token: SeDebugPrivilege 1460 WerFault.exe Token: SeDebugPrivilege 1680 Thu000ee9073d9260.exe Token: SeDebugPrivilege 984 Thu0046fa0086fb73b2f.exe Token: SeShutdownPrivilege 1268 Process not Found Token: SeDebugPrivilege 2424 taskkill.exe Token: SeDebugPrivilege 2568 WerFault.exe Token: SeShutdownPrivilege 1268 Process not Found Token: SeDebugPrivilege 1336 powershell.exe Token: SeCreateTokenPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeAssignPrimaryTokenPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeLockMemoryPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeIncreaseQuotaPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeMachineAccountPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeTcbPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeSecurityPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeTakeOwnershipPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeLoadDriverPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeSystemProfilePrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeSystemtimePrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeProfSingleProcessPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeIncBasePriorityPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeCreatePagefilePrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeCreatePermanentPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeBackupPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeRestorePrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeShutdownPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeDebugPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeAuditPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeSystemEnvironmentPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe Token: SeChangeNotifyPrivilege 2356 elIDM7ianDMh_oCzOB0avpRk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1268 Process not Found 1268 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 756 wrote to memory of 1076 756 77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe 28 PID 756 wrote to memory of 1076 756 77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe 28 PID 756 wrote to memory of 1076 756 77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe 28 PID 756 wrote to memory of 1076 756 77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe 28 PID 756 wrote to memory of 1076 756 77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe 28 PID 756 wrote to memory of 1076 756 77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe 28 PID 756 wrote to memory of 1076 756 77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe 28 PID 1076 wrote to memory of 616 1076 setup_installer.exe 29 PID 1076 wrote to memory of 616 1076 setup_installer.exe 29 PID 1076 wrote to memory of 616 1076 setup_installer.exe 29 PID 1076 wrote to memory of 616 1076 setup_installer.exe 29 PID 1076 wrote to memory of 616 1076 setup_installer.exe 29 PID 1076 wrote to memory of 616 1076 setup_installer.exe 29 PID 1076 wrote to memory of 616 1076 setup_installer.exe 29 PID 616 wrote to memory of 1552 616 setup_install.exe 31 PID 616 wrote to memory of 1552 616 setup_install.exe 31 PID 616 wrote to memory of 1552 616 setup_install.exe 31 PID 616 wrote to memory of 1552 616 setup_install.exe 31 PID 616 wrote to memory of 1552 616 setup_install.exe 31 PID 616 wrote to memory of 1552 616 setup_install.exe 31 PID 616 wrote to memory of 1552 616 setup_install.exe 31 PID 616 wrote to memory of 1612 616 setup_install.exe 32 PID 616 wrote to memory of 1612 616 setup_install.exe 32 PID 616 wrote to memory of 1612 616 setup_install.exe 32 PID 616 wrote to memory of 1612 616 setup_install.exe 32 PID 616 wrote to memory of 1612 616 setup_install.exe 32 PID 616 wrote to memory of 1612 616 setup_install.exe 32 PID 616 wrote to memory of 1612 616 setup_install.exe 32 PID 616 wrote to memory of 1972 616 setup_install.exe 34 PID 616 wrote to memory of 1972 616 setup_install.exe 34 PID 616 wrote to memory of 1972 616 setup_install.exe 34 PID 616 wrote to memory of 1972 616 setup_install.exe 34 PID 616 wrote to memory of 1972 616 setup_install.exe 34 PID 616 wrote to memory of 1972 616 setup_install.exe 34 PID 616 wrote to memory of 1972 616 setup_install.exe 34 PID 616 wrote to memory of 840 616 setup_install.exe 33 PID 616 wrote to memory of 840 616 setup_install.exe 33 PID 616 wrote to memory of 840 616 setup_install.exe 33 PID 616 wrote to memory of 840 616 setup_install.exe 33 PID 616 wrote to memory of 840 616 setup_install.exe 33 PID 616 wrote to memory of 840 616 setup_install.exe 33 PID 616 wrote to memory of 840 616 setup_install.exe 33 PID 616 wrote to memory of 1348 616 setup_install.exe 35 PID 616 wrote to memory of 1348 616 setup_install.exe 35 PID 616 wrote to memory of 1348 616 setup_install.exe 35 PID 616 wrote to memory of 1348 616 setup_install.exe 35 PID 616 wrote to memory of 1348 616 setup_install.exe 35 PID 616 wrote to memory of 1348 616 setup_install.exe 35 PID 616 wrote to memory of 1348 616 setup_install.exe 35 PID 616 wrote to memory of 1608 616 setup_install.exe 36 PID 616 wrote to memory of 1608 616 setup_install.exe 36 PID 616 wrote to memory of 1608 616 setup_install.exe 36 PID 616 wrote to memory of 1608 616 setup_install.exe 36 PID 616 wrote to memory of 1608 616 setup_install.exe 36 PID 616 wrote to memory of 1608 616 setup_install.exe 36 PID 616 wrote to memory of 1608 616 setup_install.exe 36 PID 616 wrote to memory of 1716 616 setup_install.exe 37 PID 616 wrote to memory of 1716 616 setup_install.exe 37 PID 616 wrote to memory of 1716 616 setup_install.exe 37 PID 616 wrote to memory of 1716 616 setup_install.exe 37 PID 616 wrote to memory of 1716 616 setup_install.exe 37 PID 616 wrote to memory of 1716 616 setup_install.exe 37 PID 616 wrote to memory of 1716 616 setup_install.exe 37 PID 840 wrote to memory of 1728 840 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe"C:\Users\Admin\AppData\Local\Temp\77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS434E8426\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵PID:1552
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu0024eb0c01ddf62.exe /mixone4⤵
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu0024eb0c01ddf62.exeThu0024eb0c01ddf62.exe /mixone5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu006994f743f.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu006994f743f.exeThu006994f743f.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu00e6dc783f.exe4⤵
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu00e6dc783f.exeThu00e6dc783f.exe5⤵
- Executes dropped EXE
PID:1260
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu00e1362251a3.exe4⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu00e1362251a3.exeThu00e1362251a3.exe5⤵
- Executes dropped EXE
PID:2884
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu008c1e505ef28ce.exe4⤵
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu008c1e505ef28ce.exeThu008c1e505ef28ce.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu008c1e505ef28ce.exeC:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu008c1e505ef28ce.exe6⤵
- Executes dropped EXE
PID:2480
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu00b87bb8a6c15.exe4⤵
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu00b87bb8a6c15.exeThu00b87bb8a6c15.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:2384
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu00308459d5d1.exe4⤵PID:884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu00baff0b12d.exe4⤵
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu00baff0b12d.exeThu00baff0b12d.exe5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu00c42c363480.exe4⤵
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu00c42c363480.exeThu00c42c363480.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
PID:1708 -
C:\Users\Admin\Pictures\Adobe Films\LCyVfEeuSidwmRTOmtyMi8Uk.exe"C:\Users\Admin\Pictures\Adobe Films\LCyVfEeuSidwmRTOmtyMi8Uk.exe"6⤵
- Executes dropped EXE
PID:2872
-
-
C:\Users\Admin\Pictures\Adobe Films\RjITuXzfKtugbKSf2mOAQ8s7.exe"C:\Users\Admin\Pictures\Adobe Films\RjITuXzfKtugbKSf2mOAQ8s7.exe"6⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\Pictures\Adobe Films\RjITuXzfKtugbKSf2mOAQ8s7.exe"C:\Users\Admin\Pictures\Adobe Films\RjITuXzfKtugbKSf2mOAQ8s7.exe"7⤵PID:940
-
-
-
C:\Users\Admin\Pictures\Adobe Films\YT29JeOYKhsE8g3tCNxM34uZ.exe"C:\Users\Admin\Pictures\Adobe Films\YT29JeOYKhsE8g3tCNxM34uZ.exe"6⤵
- Executes dropped EXE
PID:3052
-
-
C:\Users\Admin\Pictures\Adobe Films\MhBanFF4yfhZOkMlA4rXJAA7.exe"C:\Users\Admin\Pictures\Adobe Films\MhBanFF4yfhZOkMlA4rXJAA7.exe"6⤵
- Executes dropped EXE
PID:2332
-
-
C:\Users\Admin\Pictures\Adobe Films\8EOaWd1Lfloa9X5pJ1e7H54c.exe"C:\Users\Admin\Pictures\Adobe Films\8EOaWd1Lfloa9X5pJ1e7H54c.exe"6⤵
- Executes dropped EXE
PID:2376
-
-
C:\Users\Admin\Pictures\Adobe Films\q2Rrer7OYcVBwhxn74Q3fIun.exe"C:\Users\Admin\Pictures\Adobe Films\q2Rrer7OYcVBwhxn74Q3fIun.exe"6⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\Pictures\Adobe Films\q2Rrer7OYcVBwhxn74Q3fIun.exe"C:\Users\Admin\Pictures\Adobe Films\q2Rrer7OYcVBwhxn74Q3fIun.exe"7⤵PID:2800
-
-
-
C:\Users\Admin\Pictures\Adobe Films\u0ZEuYiy5a0j8hKqQ_zE7_xH.exe"C:\Users\Admin\Pictures\Adobe Films\u0ZEuYiy5a0j8hKqQ_zE7_xH.exe"6⤵
- Executes dropped EXE
PID:2336
-
-
C:\Users\Admin\Pictures\Adobe Films\elIDM7ianDMh_oCzOB0avpRk.exe"C:\Users\Admin\Pictures\Adobe Films\elIDM7ianDMh_oCzOB0avpRk.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2356 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:776
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:2996
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 13607⤵
- Program crash
PID:2776
-
-
-
C:\Users\Admin\Pictures\Adobe Films\RVuz7j6lZmLr7A0ka5vwZtUJ.exe"C:\Users\Admin\Pictures\Adobe Films\RVuz7j6lZmLr7A0ka5vwZtUJ.exe"6⤵
- Executes dropped EXE
PID:2432
-
-
C:\Users\Admin\Pictures\Adobe Films\L9v8f0CPxFd3_JEl1zneAqbY.exe"C:\Users\Admin\Pictures\Adobe Films\L9v8f0CPxFd3_JEl1zneAqbY.exe"6⤵
- Executes dropped EXE
PID:2392
-
-
C:\Users\Admin\Pictures\Adobe Films\9Jausx51saNOkp40AA3ocW4J.exe"C:\Users\Admin\Pictures\Adobe Films\9Jausx51saNOkp40AA3ocW4J.exe"6⤵
- Executes dropped EXE
PID:2448
-
-
C:\Users\Admin\Pictures\Adobe Films\jxbgMEgt20UGvvp2NW60fsAP.exe"C:\Users\Admin\Pictures\Adobe Films\jxbgMEgt20UGvvp2NW60fsAP.exe"6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:108
-
-
C:\Users\Admin\Pictures\Adobe Films\yoah0q_ZvLiATzh2UFN_Rgih.exe"C:\Users\Admin\Pictures\Adobe Films\yoah0q_ZvLiATzh2UFN_Rgih.exe"6⤵
- Executes dropped EXE
PID:2248
-
-
C:\Users\Admin\Pictures\Adobe Films\GKNd8JjiwUe8OB5Upfx630dA.exe"C:\Users\Admin\Pictures\Adobe Films\GKNd8JjiwUe8OB5Upfx630dA.exe"6⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\Pictures\Adobe Films\GKNd8JjiwUe8OB5Upfx630dA.exe"C:\Users\Admin\Pictures\Adobe Films\GKNd8JjiwUe8OB5Upfx630dA.exe"7⤵PID:2820
-
-
-
C:\Users\Admin\Pictures\Adobe Films\hp0NVopuBF5fbIYTy0tbD4Fo.exe"C:\Users\Admin\Pictures\Adobe Films\hp0NVopuBF5fbIYTy0tbD4Fo.exe"6⤵
- Executes dropped EXE
PID:2252
-
-
C:\Users\Admin\Pictures\Adobe Films\nKkemSjgDD3fWQSYxHPc0UrE.exe"C:\Users\Admin\Pictures\Adobe Films\nKkemSjgDD3fWQSYxHPc0UrE.exe"6⤵
- Executes dropped EXE
PID:1012
-
-
C:\Users\Admin\Pictures\Adobe Films\h2pq0QUifN7Ah156Vig9EsXx.exe"C:\Users\Admin\Pictures\Adobe Films\h2pq0QUifN7Ah156Vig9EsXx.exe"6⤵
- Executes dropped EXE
PID:564
-
-
C:\Users\Admin\Pictures\Adobe Films\bswUKV9V9ldFkYLi3yS_rNiw.exe"C:\Users\Admin\Pictures\Adobe Films\bswUKV9V9ldFkYLi3yS_rNiw.exe"6⤵
- Executes dropped EXE
PID:756
-
-
C:\Users\Admin\Pictures\Adobe Films\oLWRqC0rrYKixjpg2s7YHJNf.exe"C:\Users\Admin\Pictures\Adobe Films\oLWRqC0rrYKixjpg2s7YHJNf.exe"6⤵
- Executes dropped EXE
PID:2200
-
-
C:\Users\Admin\Pictures\Adobe Films\RNNpCdc3OwfgCA0YANUQ1Bo1.exe"C:\Users\Admin\Pictures\Adobe Films\RNNpCdc3OwfgCA0YANUQ1Bo1.exe"6⤵
- Executes dropped EXE
PID:1784
-
-
C:\Users\Admin\Pictures\Adobe Films\g89ovLd5hnd9Bg25irx6gIjL.exe"C:\Users\Admin\Pictures\Adobe Films\g89ovLd5hnd9Bg25irx6gIjL.exe"6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2456
-
-
C:\Users\Admin\Pictures\Adobe Films\JUdzauA7JmWF7VvBGBNDjlxf.exe"C:\Users\Admin\Pictures\Adobe Films\JUdzauA7JmWF7VvBGBNDjlxf.exe"6⤵
- Executes dropped EXE
PID:2464 -
C:\Program Files (x86)\Company\NewProduct\inst2.exe"C:\Program Files (x86)\Company\NewProduct\inst2.exe"7⤵PID:1452
-
-
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"7⤵PID:2276
-
-
C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"7⤵PID:972
-
-
C:\Program Files (x86)\Company\NewProduct\PBrowserSetp311019.exe"C:\Program Files (x86)\Company\NewProduct\PBrowserSetp311019.exe"7⤵PID:364
-
-
-
C:\Users\Admin\Pictures\Adobe Films\GQf7inFlzV_DW6wAotD1UjSI.exe"C:\Users\Admin\Pictures\Adobe Films\GQf7inFlzV_DW6wAotD1UjSI.exe"6⤵
- Executes dropped EXE
PID:1648
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu00381dcd157d70.exe4⤵
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu00381dcd157d70.exeThu00381dcd157d70.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 14326⤵
- Loads dropped DLL
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu000ee9073d9260.exe4⤵
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu000ee9073d9260.exeThu000ee9073d9260.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu009182426214b9c.exe4⤵
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu009182426214b9c.exeThu009182426214b9c.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu009182426214b9c.exeC:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu009182426214b9c.exe6⤵
- Executes dropped EXE
PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu009182426214b9c.exeC:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu009182426214b9c.exe6⤵
- Executes dropped EXE
PID:2544
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu0033b1bf632d.exe4⤵
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu0033b1bf632d.exeThu0033b1bf632d.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu0046fa0086fb73b2f.exe4⤵
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\7zS434E8426\Thu0046fa0086fb73b2f.exeThu0046fa0086fb73b2f.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 4764⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
-
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Disabling Security Tools
1Install Root Certificate
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1