amadey | 3f947f5a849f11be9079a5c2418240e2faf7e53b63662c85b92fad8f47ea4d09

Modify Existing Service

T1031

Disabling Security Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Sat213bfa938b854.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Sat213bfa938b854.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Sat213bfa938b854.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Sat213bfa938b854.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	Sat213bfa938b854.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	Sat213bfa938b854.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	Sat213bfa938b854.exe

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	980	rundll32.exe	20

RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
stealer recordbreaker
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

resource	yara_rule
behavioral2/memory/4020-257-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/1724-258-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/4020-260-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/1724-259-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/27264-401-0x0000000000750000-0x0000000000770000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023143-172.dat	family_socelars
behavioral2/files/0x0006000000023143-197.dat	family_socelars

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 1008 created 1296	1008	svchost.exe	154
PID 1008 created 1296	1008	svchost.exe	154

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	Sat213e424c1a444a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Cursors\compostdeb\svchost.exe = "0"	Sat213e424c1a444a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat213e424c1a444a7.exe = "0"	Sat213e424c1a444a7.exe

suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
suricata
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
suricata
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata
suricata: ET MALWARE Win32/RecordBreaker CnC Checkin
suricata: ET MALWARE Win32/RecordBreaker CnC Checkin
suricata
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/5456-347-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	Sat213e424c1a444a7.exe

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x0006000000023147-239.dat	WebBrowserPassView
behavioral2/files/0x0006000000023147-212.dat	WebBrowserPassView
behavioral2/memory/816-317-0x0000000000400000-0x000000000047C000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023147-239.dat	Nirsoft
behavioral2/files/0x0006000000023147-212.dat	Nirsoft
behavioral2/memory/876-291-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/files/0x000600000002315a-290.dat	Nirsoft
behavioral2/files/0x000600000002315a-289.dat	Nirsoft
behavioral2/memory/816-317-0x0000000000400000-0x000000000047C000-memory.dmp	Nirsoft

OnlyLogger Payload 5 IoCs

resource	yara_rule
behavioral2/memory/4768-216-0x0000000000400000-0x0000000000450000-memory.dmp	family_onlylogger
behavioral2/memory/4768-236-0x0000000000400000-0x0000000000450000-memory.dmp	family_onlylogger
behavioral2/memory/4768-211-0x0000000000400000-0x0000000000450000-memory.dmp	family_onlylogger
behavioral2/memory/4768-203-0x0000000000400000-0x0000000000450000-memory.dmp	family_onlylogger
behavioral2/memory/4768-293-0x0000000000400000-0x0000000000450000-memory.dmp	family_onlylogger

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/3740-265-0x0000000002220000-0x00000000022F9000-memory.dmp	family_vidar
behavioral2/memory/3740-275-0x0000000000400000-0x0000000000536000-memory.dmp	family_vidar
behavioral2/memory/3740-338-0x0000000002220000-0x00000000022F9000-memory.dmp	family_vidar
behavioral2/memory/3740-340-0x0000000000400000-0x0000000000536000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0009000000023134-137.dat	aspack_v212_v242
behavioral2/files/0x0009000000023134-140.dat	aspack_v212_v242
behavioral2/files/0x00090000000230fd-138.dat	aspack_v212_v242
behavioral2/files/0x00090000000230fd-145.dat	aspack_v212_v242
behavioral2/files/0x000600000002313c-146.dat	aspack_v212_v242
behavioral2/files/0x000600000002313c-143.dat	aspack_v212_v242
behavioral2/files/0x00090000000230fd-144.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 29 IoCs

pid	Process
4044	setup_installer.exe
3800	setup_install.exe
3528	Sat2155510581d1c8a.exe
2368	Sat213bfa938b854.exe
3464	Sat21dad62895f.exe
4484	Sat2139c6e21283.exe
2844	Sat2151e2a470f.exe
780	Sat213e424c1a444a7.exe
5068	Sat215c0339ff8e80f8.exe
4768	Sat2139c6e21283.exe
3740	Sat21236d0487254d.exe
1128	Sat21e641f7bbcdc.exe
5044	Sat21c50f382c.exe
2056	Sat2187d10982.exe
1088	Sat219620282e33b70.exe
1172	Sat2181ac3b37.exe
3896	Sat21903bd566084.exe
4680	Sat212a21050dc.exe
4448	Sat21ef51d9d1acdcc.exe
4776	Sat2181ac3b37.exe
1724	Sat212a21050dc.exe
4020	Sat21dad62895f.exe
852	3361c0b6-816b-4d95-a634-3e8e6243304e.exe
876	11111.exe
2084	Sat21ef51d9d1acdcc.exe
1800	Sat21ef51d9d1acdcc.tmp
852	3361c0b6-816b-4d95-a634-3e8e6243304e.exe
1296	AdvancedRun.exe
816	11111.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	Sat213e424c1a444a7.exe

Modifies Windows Firewall 1 TTPs 5 IoCs

Modify Existing Service

T1031

pid	Process
7708	netsh.exe
5236	netsh.exe
7160	netsh.exe
7212	netsh.exe
7656	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Sat213e424c1a444a7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Sat213e424c1a444a7.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	Sat2181ac3b37.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	Sat21903bd566084.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	Sat215c0339ff8e80f8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	Sat213bfa938b854.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	3361c0b6-816b-4d95-a634-3e8e6243304e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	Sat213e424c1a444a7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	3F947F5A849F11BE9079A5C2418240E2FAF7E53B63662.exe

Loads dropped DLL 12 IoCs

pid	Process
3800	setup_install.exe
3800	setup_install.exe
3800	setup_install.exe
3800	setup_install.exe
3800	setup_install.exe
3800	setup_install.exe
852	3361c0b6-816b-4d95-a634-3e8e6243304e.exe
928	rundll32.exe
928	rundll32.exe
2616	cmd.exe
2616	cmd.exe
1800	Sat21ef51d9d1acdcc.tmp

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
27464	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	Sat213e424c1a444a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	Sat213e424c1a444a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Cursors\compostdeb\svchost.exe = "0"	Sat213e424c1a444a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat213e424c1a444a7.exe = "0"	Sat213e424c1a444a7.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gorgetedcbf = "C:\\Windows\\Cursors\\compostdeb\\svchost.exe"	Sat213e424c1a444a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gorgetedcbf = "C:\\Windows\\Cursors\\compostdeb\\svchost.exe"	Sat213e424c1a444a7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
170	ipinfo.io
171	ipinfo.io
184	api.2ip.ua
185	api.2ip.ua
213	api.2ip.ua
22	ip-api.com
35	ipinfo.io
36	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Sat213e424c1a444a7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Sat213e424c1a444a7.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4484 set thread context of 4768	4484	Sat2139c6e21283.exe	101
PID 4680 set thread context of 1724	4680	Sat212a21050dc.exe	129
PID 3464 set thread context of 4020	3464	Sat21dad62895f.exe	114
PID 780 set thread context of 5456	780	Sat213e424c1a444a7.exe	163

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\compostdeb\svchost.exe	Sat213e424c1a444a7.exe
File opened for modification	C:\Windows\Cursors\compostdeb	Sat213e424c1a444a7.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6444	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 17 IoCs

pid	pid_target	Process	procid_target
4880	3800	WerFault.exe	80
4724	3740	WerFault.exe	119
5584	4768	WerFault.exe	101
16364	4764	WerFault.exe	178
27436	4764	WerFault.exe	178
27644	4764	WerFault.exe	178
27452	4764	WerFault.exe	178
1844	4764	WerFault.exe	178
4152	4764	WerFault.exe	178
5560	4764	WerFault.exe	178
4252	4612	WerFault.exe	175
844	4764	WerFault.exe	178
1824	3140	WerFault.exe	177
2632	4764	WerFault.exe	178
3028	5316	WerFault.exe	180
6648	6392	WerFault.exe	264
7064	7004	WerFault.exe	278

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat2155510581d1c8a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat2155510581d1c8a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat2155510581d1c8a.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
6056	schtasks.exe
5844	schtasks.exe
6196	schtasks.exe
6784	schtasks.exe
7972	schtasks.exe
10208	schtasks.exe

Delays execution with timeout.exe 2 IoCs

pid	Process
5944	timeout.exe
6656	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4880	tasklist.exe

Kills process with taskkill 4 IoCs

pid	Process
4152	taskkill.exe
5756	taskkill.exe
5140	taskkill.exe
6516	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2976	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	33	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4420	powershell.exe
4420	powershell.exe
208	powershell.exe
208	powershell.exe
4420	powershell.exe
4420	powershell.exe
208	powershell.exe
208	powershell.exe
3528	Sat2155510581d1c8a.exe
3528	Sat2155510581d1c8a.exe
780	Sat213e424c1a444a7.exe
780	Sat213e424c1a444a7.exe
780	Sat213e424c1a444a7.exe
780	Sat213e424c1a444a7.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe
2368	Sat213bfa938b854.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3528	Sat2155510581d1c8a.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	Sat21dad62895f.exe
Token: SeCreateTokenPrivilege	2844	Sat2151e2a470f.exe
Token: SeAssignPrimaryTokenPrivilege	2844	Sat2151e2a470f.exe
Token: SeLockMemoryPrivilege	2844	Sat2151e2a470f.exe
Token: SeIncreaseQuotaPrivilege	2844	Sat2151e2a470f.exe
Token: SeMachineAccountPrivilege	2844	Sat2151e2a470f.exe
Token: SeTcbPrivilege	2844	Sat2151e2a470f.exe
Token: SeSecurityPrivilege	2844	Sat2151e2a470f.exe
Token: SeTakeOwnershipPrivilege	2844	Sat2151e2a470f.exe
Token: SeLoadDriverPrivilege	2844	Sat2151e2a470f.exe
Token: SeSystemProfilePrivilege	2844	Sat2151e2a470f.exe
Token: SeSystemtimePrivilege	2844	Sat2151e2a470f.exe
Token: SeProfSingleProcessPrivilege	2844	Sat2151e2a470f.exe
Token: SeIncBasePriorityPrivilege	2844	Sat2151e2a470f.exe
Token: SeCreatePagefilePrivilege	2844	Sat2151e2a470f.exe
Token: SeCreatePermanentPrivilege	2844	Sat2151e2a470f.exe
Token: SeBackupPrivilege	2844	Sat2151e2a470f.exe
Token: SeRestorePrivilege	2844	Sat2151e2a470f.exe
Token: SeShutdownPrivilege	2844	Sat2151e2a470f.exe
Token: SeDebugPrivilege	2844	Sat2151e2a470f.exe
Token: SeAuditPrivilege	2844	Sat2151e2a470f.exe
Token: SeSystemEnvironmentPrivilege	2844	Sat2151e2a470f.exe
Token: SeChangeNotifyPrivilege	2844	Sat2151e2a470f.exe
Token: SeRemoteShutdownPrivilege	2844	Sat2151e2a470f.exe
Token: SeUndockPrivilege	2844	Sat2151e2a470f.exe
Token: SeSyncAgentPrivilege	2844	Sat2151e2a470f.exe
Token: SeEnableDelegationPrivilege	2844	Sat2151e2a470f.exe
Token: SeManageVolumePrivilege	2844	Sat2151e2a470f.exe
Token: SeImpersonatePrivilege	2844	Sat2151e2a470f.exe
Token: SeCreateGlobalPrivilege	2844	Sat2151e2a470f.exe
Token: 31	2844	Sat2151e2a470f.exe
Token: 32	2844	Sat2151e2a470f.exe
Token: 33	2844	Sat2151e2a470f.exe
Token: 34	2844	Sat2151e2a470f.exe
Token: 35	2844	Sat2151e2a470f.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	5044	Sat21c50f382c.exe
Token: SeDebugPrivilege	4680	Sat212a21050dc.exe
Token: SeDebugPrivilege	1128	Sat21e641f7bbcdc.exe
Token: SeDebugPrivilege	780	Sat213e424c1a444a7.exe
Token: SeDebugPrivilege	4152	WerFault.exe
Token: SeDebugPrivilege	1296	AdvancedRun.exe
Token: SeImpersonatePrivilege	1296	AdvancedRun.exe
Token: SeShutdownPrivilege	372	Process not Found
Token: SeCreatePagefilePrivilege	372	Process not Found
Token: SeShutdownPrivilege	372	Process not Found
Token: SeCreatePagefilePrivilege	372	Process not Found
Token: SeShutdownPrivilege	372	Process not Found
Token: SeCreatePagefilePrivilege	372	Process not Found
Token: SeShutdownPrivilege	372	Process not Found
Token: SeCreatePagefilePrivilege	372	Process not Found
Token: SeShutdownPrivilege	372	Process not Found
Token: SeCreatePagefilePrivilege	372	Process not Found
Token: SeShutdownPrivilege	372	Process not Found
Token: SeCreatePagefilePrivilege	372	Process not Found
Token: SeShutdownPrivilege	372	Process not Found
Token: SeCreatePagefilePrivilege	372	Process not Found
Token: SeShutdownPrivilege	372	Process not Found
Token: SeCreatePagefilePrivilege	372	Process not Found
Token: SeShutdownPrivilege	372	Process not Found
Token: SeCreatePagefilePrivilege	372	Process not Found
Token: SeShutdownPrivilege	372	Process not Found
Token: SeCreatePagefilePrivilege	372	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 4044	2240	3F947F5A849F11BE9079A5C2418240E2FAF7E53B63662.exe	79
PID 2240 wrote to memory of 4044	2240	3F947F5A849F11BE9079A5C2418240E2FAF7E53B63662.exe	79
PID 2240 wrote to memory of 4044	2240	3F947F5A849F11BE9079A5C2418240E2FAF7E53B63662.exe	79
PID 4044 wrote to memory of 3800	4044	setup_installer.exe	80
PID 4044 wrote to memory of 3800	4044	setup_installer.exe	80
PID 4044 wrote to memory of 3800	4044	setup_installer.exe	80
PID 3800 wrote to memory of 4396	3800	setup_install.exe	86
PID 3800 wrote to memory of 4396	3800	setup_install.exe	86
PID 3800 wrote to memory of 4396	3800	setup_install.exe	86
PID 3800 wrote to memory of 1940	3800	setup_install.exe	92
PID 3800 wrote to memory of 1940	3800	setup_install.exe	92
PID 3800 wrote to memory of 1940	3800	setup_install.exe	92
PID 4396 wrote to memory of 4420	4396	cmd.exe	87
PID 4396 wrote to memory of 4420	4396	cmd.exe	87
PID 4396 wrote to memory of 4420	4396	cmd.exe	87
PID 3800 wrote to memory of 4336	3800	setup_install.exe	91
PID 3800 wrote to memory of 4336	3800	setup_install.exe	91
PID 3800 wrote to memory of 4336	3800	setup_install.exe	91
PID 3800 wrote to memory of 3520	3800	setup_install.exe	88
PID 3800 wrote to memory of 3520	3800	setup_install.exe	88
PID 3800 wrote to memory of 3520	3800	setup_install.exe	88
PID 1940 wrote to memory of 208	1940	cmd.exe	89
PID 1940 wrote to memory of 208	1940	cmd.exe	89
PID 1940 wrote to memory of 208	1940	cmd.exe	89
PID 4336 wrote to memory of 3528	4336	cmd.exe	90
PID 4336 wrote to memory of 3528	4336	cmd.exe	90
PID 4336 wrote to memory of 3528	4336	cmd.exe	90
PID 3800 wrote to memory of 4612	3800	setup_install.exe	97
PID 3800 wrote to memory of 4612	3800	setup_install.exe	97
PID 3800 wrote to memory of 4612	3800	setup_install.exe	97
PID 3800 wrote to memory of 1916	3800	setup_install.exe	93
PID 3800 wrote to memory of 1916	3800	setup_install.exe	93
PID 3800 wrote to memory of 1916	3800	setup_install.exe	93
PID 3800 wrote to memory of 3668	3800	setup_install.exe	94
PID 3800 wrote to memory of 3668	3800	setup_install.exe	94
PID 3800 wrote to memory of 3668	3800	setup_install.exe	94
PID 3520 wrote to memory of 2368	3520	cmd.exe	96
PID 3520 wrote to memory of 2368	3520	cmd.exe	96
PID 3520 wrote to memory of 2368	3520	cmd.exe	96
PID 3800 wrote to memory of 1048	3800	setup_install.exe	95
PID 3800 wrote to memory of 1048	3800	setup_install.exe	95
PID 3800 wrote to memory of 1048	3800	setup_install.exe	95
PID 3800 wrote to memory of 4660	3800	setup_install.exe	106
PID 3800 wrote to memory of 4660	3800	setup_install.exe	106
PID 3800 wrote to memory of 4660	3800	setup_install.exe	106
PID 3668 wrote to memory of 3464	3668	cmd.exe	104
PID 3668 wrote to memory of 3464	3668	cmd.exe	104
PID 3668 wrote to memory of 3464	3668	cmd.exe	104
PID 3800 wrote to memory of 3472	3800	setup_install.exe	98
PID 3800 wrote to memory of 3472	3800	setup_install.exe	98
PID 3800 wrote to memory of 3472	3800	setup_install.exe	98
PID 1916 wrote to memory of 4484	1916	cmd.exe	105
PID 1916 wrote to memory of 4484	1916	cmd.exe	105
PID 1916 wrote to memory of 4484	1916	cmd.exe	105
PID 3800 wrote to memory of 3164	3800	setup_install.exe	103
PID 3800 wrote to memory of 3164	3800	setup_install.exe	103
PID 3800 wrote to memory of 3164	3800	setup_install.exe	103
PID 4612 wrote to memory of 2844	4612	cmd.exe	102
PID 4612 wrote to memory of 2844	4612	cmd.exe	102
PID 4612 wrote to memory of 2844	4612	cmd.exe	102
PID 3800 wrote to memory of 1308	3800	setup_install.exe	99
PID 3800 wrote to memory of 1308	3800	setup_install.exe	99
PID 3800 wrote to memory of 1308	3800	setup_install.exe	99
PID 4484 wrote to memory of 4768	4484	Sat2139c6e21283.exe	101

C:\Users\Admin\AppData\Local\Temp\3F947F5A849F11BE9079A5C2418240E2FAF7E53B63662.exe
"C:\Users\Admin\AppData\Local\Temp\3F947F5A849F11BE9079A5C2418240E2FAF7E53B63662.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4420
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat213bfa938b854.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat213bfa938b854.exe
        
        Sat213bfa938b854.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        
        PID:2368
      - C:\Users\Admin\Pictures\Adobe Films\vxz0h7UdH0nfjs3XYYdd4QXb.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\vxz0h7UdH0nfjs3XYYdd4QXb.exe"
        6⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" -Y .\LrUD._
        7⤵
        
        PID:5392
      - C:\Users\Admin\Pictures\Adobe Films\wP6yy0jqPvhxMFQIlFpH27hs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\wP6yy0jqPvhxMFQIlFpH27hs.exe"
        6⤵
        
        PID:6124
      - C:\Users\Admin\Pictures\Adobe Films\AqKuQOUG_hGOdJfNSwPuntV4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\AqKuQOUG_hGOdJfNSwPuntV4.exe"
        6⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:10208
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:6056
      - C:\Users\Admin\Pictures\Adobe Films\ziFKpt7BlM1hSjLUURRC3H4e.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ziFKpt7BlM1hSjLUURRC3H4e.exe"
        6⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1160
        7⤵
        Program crash
        
        PID:4252
      - C:\Users\Admin\Pictures\Adobe Films\VsCzqWxTTXk0NTHbz5pM2DSJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\VsCzqWxTTXk0NTHbz5pM2DSJ.exe"
        6⤵
        
        PID:5164
        
        C:\Users\Admin\Pictures\Adobe Films\VsCzqWxTTXk0NTHbz5pM2DSJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\VsCzqWxTTXk0NTHbz5pM2DSJ.exe"
        7⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Users\Admin\AppData\Local\87fa8f29-cd7c-4ce4-bc33-f62e1e21c20e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        8⤵
        Modifies file permissions
        
        PID:27464
        
        C:\Users\Admin\Pictures\Adobe Films\VsCzqWxTTXk0NTHbz5pM2DSJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\VsCzqWxTTXk0NTHbz5pM2DSJ.exe" --Admin IsNotAutoStart IsNotTask
        8⤵
        
        PID:3516
        
        C:\Users\Admin\Pictures\Adobe Films\VsCzqWxTTXk0NTHbz5pM2DSJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\VsCzqWxTTXk0NTHbz5pM2DSJ.exe" --Admin IsNotAutoStart IsNotTask
        9⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\46cb4a4e-735c-4933-9a0c-a9ae3f208e8c\build2.exe
        
        "C:\Users\Admin\AppData\Local\46cb4a4e-735c-4933-9a0c-a9ae3f208e8c\build2.exe"
        10⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\46cb4a4e-735c-4933-9a0c-a9ae3f208e8c\build2.exe
        
        "C:\Users\Admin\AppData\Local\46cb4a4e-735c-4933-9a0c-a9ae3f208e8c\build2.exe"
        11⤵
        
        PID:6292
      - C:\Users\Admin\Pictures\Adobe Films\FtjQj3ldsO5k8wnCuvspVUvT.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\FtjQj3ldsO5k8wnCuvspVUvT.exe"
        6⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im FtjQj3ldsO5k8wnCuvspVUvT.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\FtjQj3ldsO5k8wnCuvspVUvT.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        Loads dropped DLL
        
        PID:2616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im FtjQj3ldsO5k8wnCuvspVUvT.exe /f
        8⤵
        Kills process with taskkill
        
        PID:5756
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:5944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 1624
        7⤵
        Program crash
        
        PID:1824
      - C:\Users\Admin\Pictures\Adobe Films\xk8ShtkHQK2gcGMcUhsEe5Mv.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\xk8ShtkHQK2gcGMcUhsEe5Mv.exe"
        6⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 452
        7⤵
        Program crash
        
        PID:16364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 764
        7⤵
        Program crash
        
        PID:27436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 772
        7⤵
        Program crash
        
        PID:27644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 796
        7⤵
        Program crash
        
        PID:27452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 804
        7⤵
        Program crash
        
        PID:1844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 836
        7⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:4152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 1012
        7⤵
        Program crash
        
        PID:5560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 1356
        7⤵
        Program crash
        
        PID:844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "xk8ShtkHQK2gcGMcUhsEe5Mv.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\xk8ShtkHQK2gcGMcUhsEe5Mv.exe" & exit
        7⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "xk8ShtkHQK2gcGMcUhsEe5Mv.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:5140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 496
        7⤵
        Program crash
        
        PID:2632
      - C:\Users\Admin\Pictures\Adobe Films\8s7bFSM86USnu6raKyFghpfd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8s7bFSM86USnu6raKyFghpfd.exe"
        6⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\dllhost.exe
        
        dllhost kjdlskreshduehfiuwefuihuzhdsfbvnzmnnxcvjkhawiuoyrf8wer847345
        7⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Questo.ppt & ping -n 5 localhost
        7⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        8⤵
        
        PID:23764
        
        C:\Windows\SysWOW64\find.exe
        
        find /I /N "psuaservice.exe"
        9⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq PSUAService.exe"
        9⤵
        Enumerates processes with tasklist
        
        PID:4880
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^EMjNKsUmZgpLIzWkfbdJjdfgUCiantYcrvsDCTscDINycNZcJFvRHNEgvYTipBwUfOIkwaJvyUyDClSuCMJSIiNdSeuDqljwHTQHtOzdWqLNHqLjyMEvRpjowazYkyvVHrWJxlwOz$" Sorrideva.ppt
        9⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nostra.exe.pif
        
        Nostra.exe.pif f
        9⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nostra.exe.pif
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nostra.exe.pif
        10⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 localhost
        8⤵
        Runs ping.exe
        
        PID:2976
      - C:\Users\Admin\Pictures\Adobe Films\7DBURd5U4rXaVvmN2syOwdp9.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7DBURd5U4rXaVvmN2syOwdp9.exe"
        6⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 696
        7⤵
        Program crash
        
        PID:3028
      - C:\Users\Admin\Pictures\Adobe Films\qjBfV7etwpGIoBUctmNFCWc_.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\qjBfV7etwpGIoBUctmNFCWc_.exe"
        6⤵
        
        PID:2204
      - C:\Users\Admin\Pictures\Adobe Films\dIGMRetp0j87IM3LBhWWEjgf.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\dIGMRetp0j87IM3LBhWWEjgf.exe"
        6⤵
        
        PID:3688
        
        C:\Users\Admin\Pictures\Adobe Films\dIGMRetp0j87IM3LBhWWEjgf.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\dIGMRetp0j87IM3LBhWWEjgf.exe"
        7⤵
        
        PID:3616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        8⤵
        
        PID:2208
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        9⤵
        Modifies Windows Firewall
        
        PID:5236
        
        C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        8⤵
        
        PID:5480
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        9⤵
        
        PID:1944
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        9⤵
        Creates scheduled task(s)
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        9⤵
        
        PID:4720
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        9⤵
        Creates scheduled task(s)
        
        PID:6196
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        9⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        10⤵
        Launches sc.exe
        
        PID:6444
      - C:\Users\Admin\Pictures\Adobe Films\8hztyGF2T7jB6ytT9ZaPSlqJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8hztyGF2T7jB6ytT9ZaPSlqJ.exe"
        6⤵
        
        PID:1660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        7⤵
        
        PID:7524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        7⤵
        
        PID:7608
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:7656
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:7708
      - C:\Users\Admin\Pictures\Adobe Films\csIm4EjjJQivc_ORTHJ4TRDZ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\csIm4EjjJQivc_ORTHJ4TRDZ.exe"
        6⤵
        
        PID:1172
      - C:\Users\Admin\Pictures\Adobe Films\lfsNx_CdBuDUAvQfDThCUt92.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\lfsNx_CdBuDUAvQfDThCUt92.exe"
        6⤵
        
        PID:5484
      - C:\Users\Admin\Pictures\Adobe Films\CDawI0IZcKVgUU0tKNQ6h2Zl.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CDawI0IZcKVgUU0tKNQ6h2Zl.exe"
        6⤵
        
        PID:4872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        7⤵
        
        PID:7116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        7⤵
        
        PID:7132
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:7160
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:7212
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        7⤵
        Creates scheduled task(s)
        
        PID:7972
        
        C:\Windows\System\svchost.exe
        
        "C:\Windows\System\svchost.exe" formal
        7⤵
        
        PID:8032
      - C:\Users\Admin\Pictures\Adobe Films\O1baJ41fSAyGpRlM42_ZguOc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\O1baJ41fSAyGpRlM42_ZguOc.exe"
        6⤵
        
        PID:2392
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:27264
      - C:\Users\Admin\Pictures\Adobe Films\afEhgwNEGDM03jYVv_4QWsxm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\afEhgwNEGDM03jYVv_4QWsxm.exe"
        6⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SETUP_~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SETUP_~2.EXE
        7⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAAwAA==
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Ilojzdeibdvdehwmax2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ilojzdeibdvdehwmax2.exe"
        8⤵
        
        PID:8004
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        8⤵
        
        PID:8060
      - C:\Users\Admin\Pictures\Adobe Films\Ic3GSD635DWOtkcqTaLZQbj7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Ic3GSD635DWOtkcqTaLZQbj7.exe"
        6⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Roaming\701683.exe
        
        "C:\Users\Admin\AppData\Roaming\701683.exe"
        7⤵
        
        PID:27408
      - C:\Users\Admin\Pictures\Adobe Films\vMX_A1EMl_WyQRRfU_zzTeMz.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\vMX_A1EMl_WyQRRfU_zzTeMz.exe"
        6⤵
        
        PID:26492
        
        C:\ProgramData\3IIMZ4NTBX4LSSIH7DTL.exe
        
        "C:\ProgramData\3IIMZ4NTBX4LSSIH7DTL.exe"
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe"
        8⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\62eca45584\
        9⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\62eca45584\
        10⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bguuwe.exe /TR "C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe" /F
        9⤵
        Creates scheduled task(s)
        
        PID:6784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 872
        8⤵
        Program crash
        
        PID:6648
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im vMX_A1EMl_WyQRRfU_zzTeMz.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\vMX_A1EMl_WyQRRfU_zzTeMz.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im vMX_A1EMl_WyQRRfU_zzTeMz.exe /f
        8⤵
        Kills process with taskkill
        
        PID:6516
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:6656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat2155510581d1c8a.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat2139c6e21283.exe /mixtwo
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat2139c6e21283.exe
        
        Sat2139c6e21283.exe /mixtwo
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat21dad62895f.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21dad62895f.exe
        
        Sat21dad62895f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21dad62895f.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21dad62895f.exe
        6⤵
        Executes dropped EXE
        
        PID:4020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat215c0339ff8e80f8.exe
      4⤵
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat215c0339ff8e80f8.exe
        
        Sat215c0339ff8e80f8.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:5068
      - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" .\T2bGV.~
        6⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\T2bGV.~
        7⤵
        Loads dropped DLL
        
        PID:928
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\T2bGV.~
        8⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\T2bGV.~
        9⤵
        
        PID:5752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat2151e2a470f.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat2151e2a470f.exe
        
        Sat2151e2a470f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:4152
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat21236d0487254d.exe
      4⤵
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21236d0487254d.exe
        
        Sat21236d0487254d.exe
        5⤵
        Executes dropped EXE
        
        PID:3740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1644
        6⤵
        Program crash
        
        PID:4724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat21e641f7bbcdc.exe
      4⤵
      PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21e641f7bbcdc.exe
        
        Sat21e641f7bbcdc.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat219620282e33b70.exe
      4⤵
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat219620282e33b70.exe
        
        Sat219620282e33b70.exe
        5⤵
        Executes dropped EXE
        
        PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat21c50f382c.exe
      4⤵
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21c50f382c.exe
        
        Sat21c50f382c.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat213e424c1a444a7.exe
      4⤵
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat213e424c1a444a7.exe
        
        Sat213e424c1a444a7.exe
        5⤵
        Windows security bypass
        Looks for VirtualBox Guest Additions in registry
        Executes dropped EXE
        Looks for VMWare Tools registry key
        Checks BIOS information in registry
        Checks computer location settings
        Windows security modification
        Adds Run key to start application
        Maps connected drives based on registry
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:780
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\compostdeb\svchost.exe" -Force
        6⤵
        
        PID:3576
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\compostdeb\svchost.exe" -Force
        6⤵
        
        PID:3968
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat213e424c1a444a7.exe" -Force
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\9955b638-3bd2-441f-ae93-46113596f7b1\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9955b638-3bd2-441f-ae93-46113596f7b1\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\9955b638-3bd2-441f-ae93-46113596f7b1\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\9955b638-3bd2-441f-ae93-46113596f7b1\3361c0b6-816b-4d95-a634-3e8e6243304e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9955b638-3bd2-441f-ae93-46113596f7b1\3361c0b6-816b-4d95-a634-3e8e6243304e.exe" /o /c "Windows-Defender" /r
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:852
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"
        6⤵
        
        PID:5292
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"
        6⤵
        
        PID:5360
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
        6⤵
        
        PID:5424
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        6⤵
        
        PID:5456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat2187d10982.exe
      4⤵
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat2187d10982.exe
        
        Sat2187d10982.exe
        5⤵
        Executes dropped EXE
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        
        PID:816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat2181ac3b37.exe
      4⤵
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat2181ac3b37.exe
        
        Sat2181ac3b37.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat2181ac3b37.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat2181ac3b37.exe" -u
        6⤵
        Executes dropped EXE
        
        PID:4776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat21903bd566084.exe
      4⤵
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21903bd566084.exe
        
        Sat21903bd566084.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:3896
      - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" .\T2bGV.~
        6⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\T2bGV.~
        7⤵
        
        PID:2616
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\T2bGV.~
        8⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\T2bGV.~
        9⤵
        
        PID:5816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat21ef51d9d1acdcc.exe
      4⤵
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21ef51d9d1acdcc.exe
        
        Sat21ef51d9d1acdcc.exe
        5⤵
        Executes dropped EXE
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\is-VHV9N.tmp\Sat21ef51d9d1acdcc.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VHV9N.tmp\Sat21ef51d9d1acdcc.tmp" /SL5="$10214,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21ef51d9d1acdcc.exe"
        6⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21ef51d9d1acdcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21ef51d9d1acdcc.exe" /SILENT
        7⤵
        Executes dropped EXE
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\is-TO4H7.tmp\Sat21ef51d9d1acdcc.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TO4H7.tmp\Sat21ef51d9d1acdcc.tmp" /SL5="$20218,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat21ef51d9d1acdcc.exe" /SILENT
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat212a21050dc.exe
      4⤵
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat212a21050dc.exe
        
        Sat212a21050dc.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat212a21050dc.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat212a21050dc.exe
        6⤵
        Executes dropped EXE
        
        PID:1724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 640
      4⤵
      Program crash
      PID:4880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208

C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat2155510581d1c8a.exe
Sat2155510581d1c8a.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3528

C:\Users\Admin\AppData\Local\Temp\7zSCCFEED76\Sat2139c6e21283.exe
Sat2139c6e21283.exe /mixtwo
1⤵
- Executes dropped EXE
PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 808
  2⤵
  - Program crash
  PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3800 -ip 3800
1⤵
PID:428

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:1008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9955b638-3bd2-441f-ae93-46113596f7b1\test.bat"
1⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3740 -ip 3740
1⤵
PID:4140
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4140" "1988" "1940" "1992" "0" "0" "1996" "0" "0" "0" "0" "0"
  2⤵
  PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4768 -ip 4768
1⤵
PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4764 -ip 4764
1⤵
PID:10432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4764 -ip 4764
1⤵
PID:27380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4764 -ip 4764
1⤵
PID:27564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4764 -ip 4764
1⤵
PID:27488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4764 -ip 4764
1⤵
PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4764 -ip 4764
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4764 -ip 4764
1⤵
PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4612 -ip 4612
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4764 -ip 4764
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3140 -ip 3140
1⤵
PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4764 -ip 4764
1⤵
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5316 -ip 5316
1⤵
PID:4680

C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"
1⤵
PID:6256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6392 -ip 6392
1⤵
PID:6628

C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe
C:\Users\Admin\AppData\Local\Temp\62eca45584\bguuwe.exe
1⤵
PID:7004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 484
  2⤵
  - Program crash
  PID:7064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7004 -ip 7004
1⤵
PID:7044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

File and Directory Permissions Modification

T1222

Modify Registry

Virtualization/Sandbox Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery

Virtualization/Sandbox Evasion