isrstealer | e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3

Analysis

max time kernel
4294212s
max time network
149s
platform
windows7_x64
resource
win7-20220223-en
submitted
07-03-2022 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3.exe
Size

340KB
MD5

c7de6e9b70b3fbd8e10613217409078a
SHA1

6e858c32db2b5297e9bd109511de475c20026f2a
SHA256

e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3
SHA512

04a613b490082e525b90a49430b1456d9f5a773003690df37c5c36a7d4c4b34c9459ec6f849ac90d1a559fdb3cef25d98d6414f00422ed5dfb19939ab41047bb

Score

10^/10

isrstealer collection persistence spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1988-71-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/1988-73-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

NirSoft MailPassView 6 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1136-86-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1136-87-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1876-121-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1876-120-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1624-155-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1624-154-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral1/memory/1136-86-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1136-87-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1876-121-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1876-120-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1624-155-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1624-154-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

Executes dropped EXE 55 IoCs

pid	Process
1256	filename.exe
1988	filename.exe
1876	filename.exe
1136	filename.exe
1104	filename.exe
268	filename.exe
864	filename.exe
1876	filename.exe
684	filename.exe
1992	filename.exe
1632	filename.exe
1624	filename.exe
1104	filename.exe
984	filename.exe
1600	filename.exe
1632	filename.exe
1516	filename.exe
1816	filename.exe
1068	filename.exe
1400	filename.exe
1020	filename.exe
980	filename.exe
1644	filename.exe
296	filename.exe
920	filename.exe
684	filename.exe
1868	filename.exe
268	filename.exe
1148	filename.exe
1304	filename.exe
1612	filename.exe
1552	filename.exe
108	filename.exe
1332	filename.exe
1356	filename.exe
1972	filename.exe
1100	filename.exe
1148	filename.exe
304	filename.exe
588	filename.exe
1952	filename.exe
980	filename.exe
1652	filename.exe
552	filename.exe
1320	filename.exe
1568	filename.exe
1960	filename.exe
468	filename.exe
2004	filename.exe
1416	filename.exe
1588	filename.exe
1036	filename.exe
1048	filename.exe
1552	filename.exe
976	filename.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1136-81-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1136-85-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1136-86-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1136-87-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/864-106-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/864-110-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/864-111-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/864-112-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1876-119-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1876-121-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1876-120-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1624-153-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1624-155-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1624-154-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
520	cmd.exe
520	cmd.exe
1256	filename.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 12 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	filename.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Suspicious use of SetThreadContext 41 IoCs

description	pid	Process	procid_target
PID 1256 set thread context of 1988	1256	filename.exe	34
PID 1988 set thread context of 1876	1988	filename.exe	38
PID 1988 set thread context of 1136	1988	filename.exe	48
PID 1104 set thread context of 268	1104	filename.exe	56
PID 268 set thread context of 864	268	filename.exe	59
PID 268 set thread context of 1876	268	filename.exe	75
PID 684 set thread context of 1992	684	filename.exe	86
PID 1992 set thread context of 1632	1992	filename.exe	89
PID 1992 set thread context of 1624	1992	filename.exe	99
PID 1104 set thread context of 984	1104	filename.exe	109
PID 984 set thread context of 1600	984	filename.exe	112
PID 984 set thread context of 1632	984	filename.exe	123
PID 1516 set thread context of 1816	1516	filename.exe	132
PID 1816 set thread context of 1068	1816	filename.exe	135
PID 1816 set thread context of 1400	1816	filename.exe	148
PID 1020 set thread context of 980	1020	filename.exe	157
PID 980 set thread context of 1644	980	filename.exe	161
PID 980 set thread context of 296	980	filename.exe	171
PID 920 set thread context of 684	920	filename.exe	180
PID 684 set thread context of 1868	684	filename.exe	184
PID 684 set thread context of 268	684	filename.exe	194
PID 1148 set thread context of 1304	1148	filename.exe	203
PID 1304 set thread context of 1612	1304	filename.exe	206
PID 1304 set thread context of 1552	1304	filename.exe	217
PID 108 set thread context of 1332	108	filename.exe	225
PID 1332 set thread context of 1356	1332	filename.exe	229
PID 1332 set thread context of 1972	1332	filename.exe	239
PID 1100 set thread context of 1148	1100	filename.exe	248
PID 1148 set thread context of 304	1148	filename.exe	251
PID 1148 set thread context of 588	1148	filename.exe	262
PID 1952 set thread context of 980	1952	filename.exe	271
PID 980 set thread context of 1652	980	filename.exe	273
PID 980 set thread context of 552	980	filename.exe	285
PID 1320 set thread context of 1568	1320	filename.exe	294
PID 1568 set thread context of 1960	1568	filename.exe	298
PID 1568 set thread context of 468	1568	filename.exe	308
PID 2004 set thread context of 1416	2004	filename.exe	317
PID 1416 set thread context of 1588	1416	filename.exe	320
PID 1416 set thread context of 1036	1416	filename.exe	331
PID 1048 set thread context of 1552	1048	filename.exe	340
PID 1552 set thread context of 976	1552	filename.exe	343

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
756	e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3.exe
756	e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe
1256	filename.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3.exe
Token: SeDebugPrivilege	1256	filename.exe
Token: SeDebugPrivilege	1104	filename.exe
Token: SeDebugPrivilege	684	filename.exe
Token: SeDebugPrivilege	1104	filename.exe
Token: SeDebugPrivilege	1516	filename.exe
Token: SeDebugPrivilege	1020	filename.exe
Token: SeDebugPrivilege	920	filename.exe
Token: SeDebugPrivilege	1148	filename.exe
Token: SeDebugPrivilege	108	filename.exe
Token: SeDebugPrivilege	1100	filename.exe
Token: SeDebugPrivilege	1952	filename.exe
Token: SeDebugPrivilege	1320	filename.exe
Token: SeDebugPrivilege	2004	filename.exe
Token: SeDebugPrivilege	1048	filename.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1988	filename.exe
268	filename.exe
1992	filename.exe
984	filename.exe
1816	filename.exe
980	filename.exe
684	filename.exe
1304	filename.exe
1332	filename.exe
1148	filename.exe
980	filename.exe
1568	filename.exe
1416	filename.exe
1552	filename.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 520	756	e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3.exe	27
PID 756 wrote to memory of 520	756	e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3.exe	27
PID 756 wrote to memory of 520	756	e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3.exe	27
PID 756 wrote to memory of 520	756	e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3.exe	27
PID 520 wrote to memory of 1256	520	cmd.exe	29
PID 520 wrote to memory of 1256	520	cmd.exe	29
PID 520 wrote to memory of 1256	520	cmd.exe	29
PID 520 wrote to memory of 1256	520	cmd.exe	29
PID 1256 wrote to memory of 836	1256	filename.exe	31
PID 1256 wrote to memory of 836	1256	filename.exe	31
PID 1256 wrote to memory of 836	1256	filename.exe	31
PID 1256 wrote to memory of 836	1256	filename.exe	31
PID 836 wrote to memory of 832	836	cmd.exe	33
PID 836 wrote to memory of 832	836	cmd.exe	33
PID 836 wrote to memory of 832	836	cmd.exe	33
PID 836 wrote to memory of 832	836	cmd.exe	33
PID 1256 wrote to memory of 1988	1256	filename.exe	34
PID 1256 wrote to memory of 1988	1256	filename.exe	34
PID 1256 wrote to memory of 1988	1256	filename.exe	34
PID 1256 wrote to memory of 1988	1256	filename.exe	34
PID 1256 wrote to memory of 1988	1256	filename.exe	34
PID 1256 wrote to memory of 1988	1256	filename.exe	34
PID 1256 wrote to memory of 1988	1256	filename.exe	34
PID 1256 wrote to memory of 1988	1256	filename.exe	34
PID 1256 wrote to memory of 1556	1256	filename.exe	35
PID 1256 wrote to memory of 1556	1256	filename.exe	35
PID 1256 wrote to memory of 1556	1256	filename.exe	35
PID 1256 wrote to memory of 1556	1256	filename.exe	35
PID 1556 wrote to memory of 1404	1556	cmd.exe	37
PID 1556 wrote to memory of 1404	1556	cmd.exe	37
PID 1556 wrote to memory of 1404	1556	cmd.exe	37
PID 1556 wrote to memory of 1404	1556	cmd.exe	37
PID 1988 wrote to memory of 1876	1988	filename.exe	38
PID 1988 wrote to memory of 1876	1988	filename.exe	38
PID 1988 wrote to memory of 1876	1988	filename.exe	38
PID 1988 wrote to memory of 1876	1988	filename.exe	38
PID 1988 wrote to memory of 1876	1988	filename.exe	38
PID 1988 wrote to memory of 1876	1988	filename.exe	38
PID 1988 wrote to memory of 1876	1988	filename.exe	38
PID 1988 wrote to memory of 1876	1988	filename.exe	38
PID 1988 wrote to memory of 1876	1988	filename.exe	38
PID 1256 wrote to memory of 276	1256	filename.exe	39
PID 1256 wrote to memory of 276	1256	filename.exe	39
PID 1256 wrote to memory of 276	1256	filename.exe	39
PID 1256 wrote to memory of 276	1256	filename.exe	39
PID 276 wrote to memory of 1444	276	cmd.exe	41
PID 276 wrote to memory of 1444	276	cmd.exe	41
PID 276 wrote to memory of 1444	276	cmd.exe	41
PID 276 wrote to memory of 1444	276	cmd.exe	41
PID 1256 wrote to memory of 1772	1256	filename.exe	42
PID 1256 wrote to memory of 1772	1256	filename.exe	42
PID 1256 wrote to memory of 1772	1256	filename.exe	42
PID 1256 wrote to memory of 1772	1256	filename.exe	42
PID 1772 wrote to memory of 480	1772	cmd.exe	44
PID 1772 wrote to memory of 480	1772	cmd.exe	44
PID 1772 wrote to memory of 480	1772	cmd.exe	44
PID 1772 wrote to memory of 480	1772	cmd.exe	44
PID 1256 wrote to memory of 552	1256	filename.exe	45
PID 1256 wrote to memory of 552	1256	filename.exe	45
PID 1256 wrote to memory of 552	1256	filename.exe	45
PID 1256 wrote to memory of 552	1256	filename.exe	45
PID 552 wrote to memory of 1304	552	cmd.exe	47
PID 552 wrote to memory of 1304	552	cmd.exe	47
PID 552 wrote to memory of 1304	552	cmd.exe	47

C:\Users\Admin\AppData\Local\Temp\e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3.exe
"C:\Users\Admin\AppData\Local\Temp\e9adf93ac9aae1f1506840e8d20401fb94e6a1f3dd968f326d62081a8ee629b3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
    "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:836
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:832
  - - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
      "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\wYwY1aFdwW.ini"
        5⤵
        Executes dropped EXE
        
        PID:1876
    - - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\neC9k6GyN6.ini"
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:1136
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1404
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:276
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        
        PID:1444
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1772
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:480
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:552
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:1304
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:1768
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:896
  - - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
      "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:1104
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        5⤵
        
        PID:912
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        6⤵
        
        PID:568
    - - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:268
      - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\zx8k8H2ZJx.ini"
        6⤵
        Executes dropped EXE
        
        PID:864
      - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\7RcUt7mom7.ini"
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:1876
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        5⤵
        
        PID:844
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        6⤵
        
        PID:1552
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        5⤵
        
        PID:1536
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        6⤵
        Adds Run key to start application
        
        PID:984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        5⤵
        
        PID:1020
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        6⤵
        
        PID:836
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        5⤵
        
        PID:1096
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        6⤵
        Adds Run key to start application
        
        PID:2032
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        5⤵
        
        PID:1928
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        6⤵
        Adds Run key to start application
        
        PID:2040
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        5⤵
        
        PID:300
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        6⤵
        
        PID:2000
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        5⤵
        
        PID:2008
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        6⤵
        
        PID:1784
    - - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:684
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        6⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        7⤵
        Adds Run key to start application
        
        PID:1788
      - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1992
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\A4jyHHn4Rl.ini"
        7⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\KFo8JrdyAO.ini"
        7⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:1624
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        6⤵
        
        PID:844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        7⤵
        Adds Run key to start application
        
        PID:1600
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        6⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        7⤵
        
        PID:1248
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        6⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        7⤵
        
        PID:1820
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        6⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        7⤵
        Adds Run key to start application
        
        PID:1320
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        6⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        7⤵
        Adds Run key to start application
        
        PID:560
      - C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        7⤵
        
        PID:112
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        8⤵
        Adds Run key to start application
        
        PID:1780
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:984
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\IQTXKrnqqI.ini"
        8⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\0qCTpf9ePn.ini"
        8⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:1632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        7⤵
        
        PID:912
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        8⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        7⤵
        
        PID:980
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        8⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        7⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        8⤵
        Adds Run key to start application
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        8⤵
        Adds Run key to start application
        
        PID:756
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        7⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        8⤵
        Adds Run key to start application
        
        PID:1704
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        8⤵
        
        PID:552
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        9⤵
        Adds Run key to start application
        
        PID:1788
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1816
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\saJ2md2OQv.ini"
        9⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\W0eHqIAmTG.ini"
        9⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:1400
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        8⤵
        
        PID:912
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        9⤵
        Adds Run key to start application
        
        PID:2008
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        9⤵
        Adds Run key to start application
        
        PID:1292
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        8⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        9⤵
        Adds Run key to start application
        
        PID:1256
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        8⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        9⤵
        Adds Run key to start application
        
        PID:684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        8⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        9⤵
        
        PID:1760
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        9⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        10⤵
        Adds Run key to start application
        
        PID:912
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:980
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\kxCMoXKU7r.ini"
        10⤵
        Executes dropped EXE
        
        PID:1644
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\hU0nb5dyCB.ini"
        10⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        9⤵
        
        PID:540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        10⤵
        Adds Run key to start application
        
        PID:1376
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        9⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        10⤵
        Adds Run key to start application
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        9⤵
        
        PID:836
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        10⤵
        Adds Run key to start application
        
        PID:480
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        9⤵
        
        PID:108
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        10⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        9⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        10⤵
        
        PID:1532
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        10⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        11⤵
        Adds Run key to start application
        
        PID:1356
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:684
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\olmc2sJXzD.ini"
        11⤵
        Executes dropped EXE
        
        PID:1868
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\art7dzv4t7.ini"
        11⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:268
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        10⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        11⤵
        Adds Run key to start application
        
        PID:832
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        10⤵
        
        PID:836
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        11⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        10⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        11⤵
        Adds Run key to start application
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        10⤵
        
        PID:588
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        11⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        10⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        11⤵
        Adds Run key to start application
        
        PID:296
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        11⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        12⤵
        Adds Run key to start application
        
        PID:1652
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\fIrCmFQZqn.ini"
        12⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\cmyKlPGDxS.ini"
        12⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:1552
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        11⤵
        
        PID:480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        12⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        11⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        12⤵
        Adds Run key to start application
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        11⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        12⤵
        Adds Run key to start application
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        11⤵
        
        PID:836
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        12⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        11⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        12⤵
        Adds Run key to start application
        
        PID:1876
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        12⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        13⤵
        
        PID:1512
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1332
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\o4vqNsAP7e.ini"
        13⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\uiplLvry6n.ini"
        13⤵
        Executes dropped EXE
        
        PID:1972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        12⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        13⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        12⤵
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        13⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        12⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        13⤵
        Adds Run key to start application
        
        PID:1648
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        12⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        13⤵
        Adds Run key to start application
        
        PID:760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        12⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        13⤵
        Adds Run key to start application
        
        PID:112
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        13⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        14⤵
        Adds Run key to start application
        
        PID:1076
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1148
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\uhLl82U64i.ini"
        14⤵
        Executes dropped EXE
        
        PID:304
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\2aT6ZVNfEe.ini"
        14⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:588
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        13⤵
        
        PID:540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        14⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        13⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        14⤵
        Adds Run key to start application
        
        PID:1816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        13⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        14⤵
        
        PID:608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        13⤵
        
        PID:844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        14⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        13⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        14⤵
        Adds Run key to start application
        
        PID:1928
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        14⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        15⤵
        Adds Run key to start application
        
        PID:1960
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:980
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\H5fH4iwDCo.ini"
        15⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\f0HVwhs0nF.ini"
        15⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:552
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        14⤵
        
        PID:684
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        15⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        14⤵
        
        PID:672
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        15⤵
        Adds Run key to start application
        
        PID:1312
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        14⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        15⤵
        Adds Run key to start application
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        14⤵
        
        PID:468
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        15⤵
        Adds Run key to start application
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        14⤵
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        15⤵
        Adds Run key to start application
        
        PID:1600
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        15⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        16⤵
        Adds Run key to start application
        
        PID:776
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1568
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\Hhx2wkzipX.ini"
        16⤵
        Executes dropped EXE
        
        PID:1960
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\pbAn58xU9o.ini"
        16⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        15⤵
        
        PID:800
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        16⤵
        
        PID:668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        15⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        16⤵
        Adds Run key to start application
        
        PID:1816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        15⤵
        
        PID:992
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        16⤵
        Adds Run key to start application
        
        PID:1628
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        15⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        16⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        15⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        16⤵
        Adds Run key to start application
        
        PID:1348
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        16⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        17⤵
        Adds Run key to start application
        
        PID:1952
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1416
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\edyZegzGWY.ini"
        17⤵
        Executes dropped EXE
        
        PID:1588
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\pFMs01SctC.ini"
        17⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:1036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        16⤵
        
        PID:832
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        17⤵
        Adds Run key to start application
        
        PID:1764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        16⤵
        
        PID:952
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        17⤵
        Adds Run key to start application
        
        PID:1596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        16⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        17⤵
        Adds Run key to start application
        
        PID:1068
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        16⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        17⤵
        Adds Run key to start application
        
        PID:544
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        16⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        17⤵
        
        PID:1544
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        17⤵
        
        PID:268
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        18⤵
        Adds Run key to start application
        
        PID:1020
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        "C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Users\Admin\Desktop\ca\vsdshsgvv\filename.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\Cy0Kov2jFp.ini"
        18⤵
        Executes dropped EXE
        
        PID:976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        17⤵
        
        PID:968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        18⤵
        Adds Run key to start application
        
        PID:776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-325-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/108-328-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/108-323-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/684-143-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/684-145-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/684-141-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/756-57-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/756-54-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/756-56-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/756-55-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/864-112-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/864-111-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/864-106-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/864-110-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/920-271-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/920-272-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/920-274-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1020-227-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1020-228-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1020-226-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1048-473-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1048-475-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/1048-470-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/1100-371-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1100-372-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/1100-370-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/1104-91-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/1104-158-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download
memory/1104-160-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download
memory/1104-159-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/1104-92-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1104-90-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1136-86-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1136-81-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1136-85-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1136-87-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1148-310-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/1148-311-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1148-309-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-65-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-63-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-64-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1320-431-0x0000000073A40000-0x0000000073FEB000-memory.dmp

Filesize
5.7MB

Download
memory/1320-432-0x00000000001D0000-0x0000000000210000-memory.dmp

Filesize
256KB

Download
memory/1320-433-0x0000000073A40000-0x0000000073FEB000-memory.dmp

Filesize
5.7MB

Download
memory/1516-192-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download
memory/1516-193-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/1516-194-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download
memory/1624-154-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1624-155-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1624-153-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1876-119-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1876-121-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1876-120-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1952-398-0x0000000073A40000-0x0000000073FEB000-memory.dmp

Filesize
5.7MB

Download
memory/1952-396-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/1952-395-0x0000000073A40000-0x0000000073FEB000-memory.dmp

Filesize
5.7MB

Download
memory/1988-73-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1988-71-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1988-69-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1988-67-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2004-460-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/2004-459-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-461-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download