Overview

overview

10

Static

static

242713ef2f...95.exe

windows7_x64

10

242713ef2f...95.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    156s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    01-02-2022 07:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95.exe

  • Size

    1.2MB

  • MD5

    a93bd199d34d21cc9102600c6ce782cf

  • SHA1

    31b50d84aa1af4f0e76a523382caba476f6e45dc

  • SHA256

    242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95

  • SHA512

    642e0cacf80a54ffa8f1bdeebb2a9b9449bb062bc331924ff8b6c93853ade68cdbd23928081d7c5da7bce944f5c553b0c4b05bd90fda525f017415bd891534c2

Score
10/10
matrixdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 52 IoCs
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 51 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies file permissions 1 TTPs 26 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95.exe
    "C:\Users\Admin\AppData\Local\Temp\242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95.exe"
    1⤵
    • Matrix Ransomware
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95.exe" "C:\Users\Admin\AppData\Local\Temp\NWfQ50yE.exe"
      2⤵
        PID:1840
      • C:\Users\Admin\AppData\Local\Temp\NWfQ50yE.exe
        "C:\Users\Admin\AppData\Local\Temp\NWfQ50yE.exe" -n
        2⤵
        • Executes dropped EXE
        PID:4580
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\CYN1s9yh.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3240
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\CYN1s9yh.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:1608
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:2388
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:4808
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\qpJECGpw.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1272
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\qpJECGpw.vbs"
              3⤵
                PID:4616
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2272
              • C:\Windows\SysWOW64\cacls.exe
                cacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
                3⤵
                  PID:4904
                • C:\Windows\SysWOW64\takeown.exe
                  takeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"
                  3⤵
                  • Modifies file permissions
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4572
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "store.db" -nobanner
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:612
                  • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                    quE6wSrR.exe -accepteula "store.db" -nobanner
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4380
                    • C:\Users\Admin\AppData\Local\Temp\quE6wSrR64.exe
                      quE6wSrR.exe -accepteula "store.db" -nobanner
                      5⤵
                      • Drops file in Drivers directory
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: LoadsDriver
                      • Suspicious use of AdjustPrivilegeToken
                      PID:500
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4460
                • C:\Windows\SysWOW64\cacls.exe
                  cacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
                  3⤵
                    PID:2912
                  • C:\Windows\SysWOW64\takeown.exe
                    takeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
                    3⤵
                    • Modifies file permissions
                    PID:820
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "store.db" -nobanner
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4040
                    • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                      quE6wSrR.exe -accepteula "store.db" -nobanner
                      4⤵
                      • Executes dropped EXE
                      PID:1280
                  • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                    quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                    3⤵
                    • Executes dropped EXE
                    PID:4056
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa""
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4716
                  • C:\Windows\SysWOW64\cacls.exe
                    cacls "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa" /E /G Admin:F /C
                    3⤵
                      PID:1508
                    • C:\Windows\SysWOW64\takeown.exe
                      takeown /F "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa"
                      3⤵
                      • Modifies file permissions
                      PID:2644
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "classes.jsa" -nobanner
                      3⤵
                        PID:4624
                        • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                          quE6wSrR.exe -accepteula "classes.jsa" -nobanner
                          4⤵
                          • Executes dropped EXE
                          PID:5008
                      • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                        quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                        3⤵
                        • Executes dropped EXE
                        PID:2064
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""
                      2⤵
                        PID:3488
                        • C:\Windows\SysWOW64\cacls.exe
                          cacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C
                          3⤵
                            PID:4256
                          • C:\Windows\SysWOW64\takeown.exe
                            takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"
                            3⤵
                            • Modifies file permissions
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3824
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                            3⤵
                              PID:2732
                              • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                4⤵
                                • Executes dropped EXE
                                PID:112
                            • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                              quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                              3⤵
                              • Executes dropped EXE
                              PID:3424
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""
                            2⤵
                              PID:2804
                              • C:\Windows\SysWOW64\cacls.exe
                                cacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C
                                3⤵
                                  PID:2952
                                • C:\Windows\SysWOW64\takeown.exe
                                  takeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"
                                  3⤵
                                  • Modifies file permissions
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1976
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                  3⤵
                                    PID:700
                                    • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                      quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                      4⤵
                                      • Executes dropped EXE
                                      PID:1932
                                  • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                    quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                    3⤵
                                    • Executes dropped EXE
                                    PID:5068
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Security\BrowserCore\manifest.json""
                                  2⤵
                                    PID:4676
                                    • C:\Windows\SysWOW64\cacls.exe
                                      cacls "C:\Program Files\Windows Security\BrowserCore\manifest.json" /E /G Admin:F /C
                                      3⤵
                                        PID:2260
                                      • C:\Windows\SysWOW64\takeown.exe
                                        takeown /F "C:\Program Files\Windows Security\BrowserCore\manifest.json"
                                        3⤵
                                        • Modifies file permissions
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3792
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "manifest.json" -nobanner
                                        3⤵
                                          PID:4780
                                          • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                            quE6wSrR.exe -accepteula "manifest.json" -nobanner
                                            4⤵
                                            • Executes dropped EXE
                                            PID:2844
                                        • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                          quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                          3⤵
                                          • Executes dropped EXE
                                          PID:4680
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa""
                                        2⤵
                                          PID:3100
                                          • C:\Windows\SysWOW64\cacls.exe
                                            cacls "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa" /E /G Admin:F /C
                                            3⤵
                                              PID:2712
                                            • C:\Windows\SysWOW64\takeown.exe
                                              takeown /F "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa"
                                              3⤵
                                              • Modifies file permissions
                                              PID:4132
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "classes.jsa" -nobanner
                                              3⤵
                                                PID:2972
                                                • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                  quE6wSrR.exe -accepteula "classes.jsa" -nobanner
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:2380
                                              • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                3⤵
                                                • Executes dropped EXE
                                                PID:4336
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""
                                              2⤵
                                                PID:3916
                                                • C:\Windows\SysWOW64\cacls.exe
                                                  cacls "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                  3⤵
                                                    PID:1576
                                                  • C:\Windows\SysWOW64\takeown.exe
                                                    takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"
                                                    3⤵
                                                    • Modifies file permissions
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1040
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                    3⤵
                                                      PID:64
                                                      • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                        quE6wSrR.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:2512
                                                    • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                      quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:4324
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""
                                                    2⤵
                                                      PID:3068
                                                      • C:\Windows\SysWOW64\cacls.exe
                                                        cacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                        3⤵
                                                          PID:5000
                                                        • C:\Windows\SysWOW64\takeown.exe
                                                          takeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"
                                                          3⤵
                                                          • Modifies file permissions
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1780
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                          3⤵
                                                            PID:1280
                                                            • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                              quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:3400
                                                          • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                            quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:1088
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui""
                                                          2⤵
                                                            PID:1028
                                                            • C:\Windows\SysWOW64\cacls.exe
                                                              cacls "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui" /E /G Admin:F /C
                                                              3⤵
                                                                PID:856
                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                takeown /F "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui"
                                                                3⤵
                                                                • Modifies file permissions
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3912
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "BrowserCore.exe.mui" -nobanner
                                                                3⤵
                                                                  PID:2644
                                                                  • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                    quE6wSrR.exe -accepteula "BrowserCore.exe.mui" -nobanner
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    PID:400
                                                                • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                  quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:4624
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""
                                                                2⤵
                                                                  PID:2100
                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                    cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                    3⤵
                                                                      PID:2756
                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                      takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"
                                                                      3⤵
                                                                      • Modifies file permissions
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:176
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                      3⤵
                                                                        PID:4444
                                                                        • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                          quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:1412
                                                                      • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                        quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:404
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""
                                                                      2⤵
                                                                        PID:984
                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                          cacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                          3⤵
                                                                            PID:4332
                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                            takeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"
                                                                            3⤵
                                                                            • Modifies file permissions
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2576
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                            3⤵
                                                                              PID:1692
                                                                              • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                PID:5116
                                                                            • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                              quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:368
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""
                                                                            2⤵
                                                                              PID:4864
                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                cacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                3⤵
                                                                                  PID:2432
                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                  takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"
                                                                                  3⤵
                                                                                  • Modifies file permissions
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1448
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                  3⤵
                                                                                    PID:1872
                                                                                    • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                      quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                      4⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4020
                                                                                  • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                    quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:4652
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe""
                                                                                  2⤵
                                                                                    PID:4632
                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                      cacls "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C
                                                                                      3⤵
                                                                                        PID:1220
                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                        takeown /F "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:4084
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "ImagingDevices.exe" -nobanner
                                                                                        3⤵
                                                                                          PID:1160
                                                                                          • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                            quE6wSrR.exe -accepteula "ImagingDevices.exe" -nobanner
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4184
                                                                                        • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                          quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3064
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Mail\wabmig.exe""
                                                                                        2⤵
                                                                                          PID:3760
                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                            cacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C
                                                                                            3⤵
                                                                                              PID:2032
                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                              takeown /F "C:\Program Files\Windows Mail\wabmig.exe"
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4240
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "wabmig.exe" -nobanner
                                                                                              3⤵
                                                                                                PID:4480
                                                                                                • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                  quE6wSrR.exe -accepteula "wabmig.exe" -nobanner
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2108
                                                                                              • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1764
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""
                                                                                              2⤵
                                                                                                PID:4944
                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                  cacls "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                  3⤵
                                                                                                    PID:3424
                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                    takeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"
                                                                                                    3⤵
                                                                                                    • Modifies file permissions
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3896
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                    3⤵
                                                                                                      PID:980
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                        quE6wSrR.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:1956
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                      quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1928
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe""
                                                                                                    2⤵
                                                                                                      PID:3216
                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                        cacls "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe" /E /G Admin:F /C
                                                                                                        3⤵
                                                                                                          PID:3728
                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                          takeown /F "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe"
                                                                                                          3⤵
                                                                                                          • Modifies file permissions
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2304
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "BrowserCore.exe" -nobanner
                                                                                                          3⤵
                                                                                                            PID:3268
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                              quE6wSrR.exe -accepteula "BrowserCore.exe" -nobanner
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:536
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                            quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2104
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""
                                                                                                          2⤵
                                                                                                            PID:4676
                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                              cacls "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                              3⤵
                                                                                                                PID:2712
                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                takeown /F "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"
                                                                                                                3⤵
                                                                                                                • Modifies file permissions
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4132
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                3⤵
                                                                                                                  PID:2596
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                    quE6wSrR.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                    4⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:2388
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                  quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                  3⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:4808
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""
                                                                                                                2⤵
                                                                                                                  PID:1888
                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                    cacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                    3⤵
                                                                                                                      PID:444
                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                      takeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"
                                                                                                                      3⤵
                                                                                                                      • Modifies file permissions
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:1576
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                      3⤵
                                                                                                                        PID:4136
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                          quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                          4⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2332
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                        quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:64
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""
                                                                                                                      2⤵
                                                                                                                        PID:4196
                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                          cacls "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                          3⤵
                                                                                                                            PID:1348
                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                            takeown /F "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"
                                                                                                                            3⤵
                                                                                                                            • Modifies file permissions
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:3972
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                            3⤵
                                                                                                                              PID:1336
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                quE6wSrR.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:4040
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                              quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1204
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""
                                                                                                                            2⤵
                                                                                                                              PID:4356
                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                cacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                3⤵
                                                                                                                                  PID:1508
                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                  takeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:856
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                  3⤵
                                                                                                                                    PID:3912
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                      quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                      4⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:1636
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                    quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2644
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Mail\wab.exe""
                                                                                                                                  2⤵
                                                                                                                                    PID:5012
                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                      cacls "C:\Program Files\Windows Mail\wab.exe" /E /G Admin:F /C
                                                                                                                                      3⤵
                                                                                                                                        PID:176
                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                        takeown /F "C:\Program Files\Windows Mail\wab.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4024
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "wab.exe" -nobanner
                                                                                                                                        3⤵
                                                                                                                                          PID:4444
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                            quE6wSrR.exe -accepteula "wab.exe" -nobanner
                                                                                                                                            4⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1328
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                          quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:4208
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""
                                                                                                                                        2⤵
                                                                                                                                          PID:3000
                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                            cacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                            3⤵
                                                                                                                                              PID:2576
                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                              takeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"
                                                                                                                                              3⤵
                                                                                                                                              • Modifies file permissions
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:4892
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                              3⤵
                                                                                                                                                PID:3796
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                                  quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5060
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                                quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4164
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""
                                                                                                                                              2⤵
                                                                                                                                                PID:4384
                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                  cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1448
                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                    takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:2572
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1872
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                                        quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:4608
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                                      quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1048
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1296
                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                        cacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4084
                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                          takeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:1468
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1160
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                                              quE6wSrR.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                              4⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:3172
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                                            quE6wSrR.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:1056
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87nz0VJc.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4560
                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                              cacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2796
                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                takeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"
                                                                                                                                                                3⤵
                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:3824
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2108
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\quE6wSrR.exe
                                                                                                                                                                    quE6wSrR.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:112
                                                                                                                                                            • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                              C:\Windows\System32\WaaSMedicAgent.exe 75ce6a99f3a6d3c01fd75538d49a86f9 YduDj5TrIUWz4U/3pjPoQA.0.1.0.0.0
                                                                                                                                                              1⤵
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              PID:4748
                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4708

                                                                                                                                                              Network

                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads