djvu | e8e4a4c7c5c593136058722cabe2d42631feffde95d923f5fd7020b0c7286f22

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	windows_update.exe

ModiLoader Second Stage 39 IoCs

resource	yara_rule
behavioral2/memory/3176-145-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-146-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-147-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-148-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-150-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-151-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-152-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-149-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-154-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-153-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-155-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-156-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-158-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-159-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-160-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-157-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-162-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-163-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-164-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-161-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-165-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-166-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-167-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-169-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-168-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-170-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-174-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-175-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-176-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-178-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-177-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-185-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-186-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-187-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-188-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-189-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-190-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-191-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2
behavioral2/memory/3176-192-0x0000000006ED0000-0x0000000006F2B000-memory.dmp	modiloader_stage2

Vidar Stealer 8 IoCs

stealer

resource	yara_rule
behavioral2/memory/260-285-0x0000000000400000-0x0000000000462000-memory.dmp	family_vidar
behavioral2/memory/260-283-0x0000000000400000-0x0000000000462000-memory.dmp	family_vidar
behavioral2/memory/260-273-0x0000000000400000-0x0000000000462000-memory.dmp	family_vidar
behavioral2/memory/260-301-0x0000000000400000-0x0000000000462000-memory.dmp	family_vidar
behavioral2/memory/4452-340-0x0000000000EC0000-0x0000000000F0F000-memory.dmp	family_vidar
behavioral2/memory/4452-341-0x0000000000400000-0x0000000000B58000-memory.dmp	family_vidar
behavioral2/memory/4428-343-0x0000000000DB0000-0x0000000000DFF000-memory.dmp	family_vidar
behavioral2/memory/4428-345-0x0000000000400000-0x0000000000B58000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2296	2V0IUz6l9dqKeDXQnTSUJW_H.exe
4716	y_vCuk_9JQtIvId56WIBtl4p.exe
3560	31hQt8COjR_FmH0z7frq_H9J.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e63-221.dat	upx
behavioral2/files/0x0006000000022e63-220.dat	upx
behavioral2/memory/2608-250-0x0000000000400000-0x0000000000C96000-memory.dmp	upx
behavioral2/files/0x0006000000022e8b-264.dat	upx
behavioral2/files/0x0006000000022e8b-261.dat	upx
behavioral2/files/0x0006000000022e8a-281.dat	upx
behavioral2/files/0x0006000000022e86-277.dat	upx
behavioral2/memory/4240-296-0x00007FFDA2BF0000-0x00007FFDA2BFF000-memory.dmp	upx
behavioral2/memory/4240-297-0x00007FFD9A490000-0x00007FFD9A4A9000-memory.dmp	upx
behavioral2/memory/4240-294-0x00007FFD90170000-0x00007FFD90194000-memory.dmp	upx
behavioral2/files/0x0006000000022e8c-291.dat	upx
behavioral2/files/0x0006000000022e8c-290.dat	upx
behavioral2/files/0x0006000000022e88-289.dat	upx
behavioral2/files/0x0006000000022e88-288.dat	upx
behavioral2/files/0x0006000000022e8a-280.dat	upx
behavioral2/files/0x0006000000022e86-279.dat	upx
behavioral2/memory/4240-272-0x00007FFD88B90000-0x00007FFD88FCD000-memory.dmp	upx
behavioral2/files/0x0006000000022e85-304.dat	upx
behavioral2/files/0x0006000000022e87-305.dat	upx
behavioral2/memory/4240-310-0x00007FFD99800000-0x00007FFD9981B000-memory.dmp	upx
behavioral2/memory/4240-311-0x00007FFD8AE40000-0x00007FFD8AE84000-memory.dmp	upx
behavioral2/files/0x0006000000022e87-306.dat	upx
behavioral2/files/0x0006000000022e85-302.dat	upx
behavioral2/memory/4240-299-0x00007FFDA2BB0000-0x00007FFDA2BBD000-memory.dmp	upx
behavioral2/memory/2608-359-0x0000000000400000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4240-368-0x00007FFD88B90000-0x00007FFD88FCD000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	windows_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	windows_update.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	windows_update.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
33720	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3176-130-0x0000000000060000-0x00000000003CD000-memory.dmp	themida
behavioral2/memory/3176-132-0x0000000000060000-0x00000000003CD000-memory.dmp	themida
behavioral2/memory/3176-134-0x0000000000060000-0x00000000003CD000-memory.dmp	themida
behavioral2/memory/216-193-0x0000000000060000-0x00000000003CD000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	windows_update.exe

Looks up external IP address via web service 9 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
142	ipinfo.io
161	api.2ip.ua
178	ipinfo.io
236	api.2ip.ua
226	ip-api.com
32	ipinfo.io
33	ipinfo.io
143	ipinfo.io
160	api.2ip.ua

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3176	windows_update.exe

Detects Pyinstaller 3 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0007000000022e70-249.dat	pyinstaller
behavioral2/files/0x0007000000022e70-246.dat	pyinstaller
behavioral2/files/0x0007000000022e70-260.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 13 IoCs

pid	pid_target	Process	procid_target
20836	2616	WerFault.exe	98
33764	2616	WerFault.exe	98
1860	2616	WerFault.exe	98
5020	328	WerFault.exe	108
808	2616	WerFault.exe	98
5244	2616	WerFault.exe	98
5428	5000	WerFault.exe	142
5524	2292	WerFault.exe	145
5656	2616	WerFault.exe	98
5884	5000	WerFault.exe	142
6024	2616	WerFault.exe	98
6276	5000	WerFault.exe	142
6324	6152	WerFault.exe	179

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
23912	schtasks.exe
23988	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
6372	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5932	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3176	windows_update.exe
3176	windows_update.exe
216	windows_update.exe
216	windows_update.exe
216	windows_update.exe
216	windows_update.exe
216	windows_update.exe
216	windows_update.exe
216	windows_update.exe
216	windows_update.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe
2364	t9BLLGn0MAPLIRBga5bC9saN.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87
PID 3176 wrote to memory of 216	3176	windows_update.exe	87

C:\Users\Admin\AppData\Local\Temp\windows_update.exe
"C:\Users\Admin\AppData\Local\Temp\windows_update.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\windows_update.exe
  C:\Users\Admin\AppData\Local\Temp\windows_update.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- - C:\Users\Admin\Pictures\Adobe Films\t9BLLGn0MAPLIRBga5bC9saN.exe
    "C:\Users\Admin\Pictures\Adobe Films\t9BLLGn0MAPLIRBga5bC9saN.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2364
- - C:\Users\Admin\Pictures\Adobe Films\2V0IUz6l9dqKeDXQnTSUJW_H.exe
    "C:\Users\Admin\Pictures\Adobe Films\2V0IUz6l9dqKeDXQnTSUJW_H.exe"
    3⤵
    - Executes dropped EXE
    PID:2296
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:23912
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:23988
  - - C:\Users\Admin\Documents\X22U24zUbH24j4rNl7vGDrP0.exe
      "C:\Users\Admin\Documents\X22U24zUbH24j4rNl7vGDrP0.exe"
      4⤵
      PID:20828
    - - C:\Users\Admin\Pictures\Adobe Films\tvrx1T07EmeBJuLb9KebzRac.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\tvrx1T07EmeBJuLb9KebzRac.exe"
        5⤵
        
        PID:528
    - - C:\Users\Admin\Pictures\Adobe Films\WuRvi4j5MU6HEMRryvNSBqRP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\WuRvi4j5MU6HEMRryvNSBqRP.exe"
        5⤵
        
        PID:2320
    - - C:\Users\Admin\Pictures\Adobe Films\nUQIBy2CmTbzbdqnQu7fjHoD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\nUQIBy2CmTbzbdqnQu7fjHoD.exe"
        5⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\7zSCACD.tmp\Install.exe
        
        .\Install.exe
        6⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\7zS6.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        7⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        8⤵
        
        PID:6404
    - - C:\Users\Admin\Pictures\Adobe Films\o_4nxlInVq4ZFDiUAcmwuw7o.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\o_4nxlInVq4ZFDiUAcmwuw7o.exe"
        5⤵
        
        PID:5000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 452
        6⤵
        Program crash
        
        PID:5428
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 772
        6⤵
        Program crash
        
        PID:5884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 780
        6⤵
        Program crash
        
        PID:6276
    - - C:\Users\Admin\Pictures\Adobe Films\Klp0cRCr6cUZwXRv0TL_5Lzn.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Klp0cRCr6cUZwXRv0TL_5Lzn.exe"
        5⤵
        
        PID:1412
      - C:\Windows\SysWOW64\dllhost.exe
        
        dllhost kjdlskreshduehfiuwefuihuzhdsfbvnzmnnxcvjkhawiuoyrf8wer847345
        6⤵
        
        PID:2720
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Questo.ppt & ping -n 5 localhost
        6⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        7⤵
        
        PID:5208
    - - C:\Users\Admin\Pictures\Adobe Films\o3AvaYhnPXxmmtS0uZECBn6N.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\o3AvaYhnPXxmmtS0uZECBn6N.exe"
        5⤵
        
        PID:2292
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2292 -s 868
        6⤵
        Program crash
        
        PID:5524
    - - C:\Users\Admin\Pictures\Adobe Films\1fe1t7dzkhR5e04tSId1Uz7u.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1fe1t7dzkhR5e04tSId1Uz7u.exe"
        5⤵
        
        PID:4340
      - C:\Users\Admin\Pictures\Adobe Films\1fe1t7dzkhR5e04tSId1Uz7u.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1fe1t7dzkhR5e04tSId1Uz7u.exe" H
        6⤵
        
        PID:208
    - - C:\Users\Admin\Pictures\Adobe Films\IPv1D5VMntCqYLG8hxpGSbE7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\IPv1D5VMntCqYLG8hxpGSbE7.exe"
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\is-AUEBR.tmp\IPv1D5VMntCqYLG8hxpGSbE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-AUEBR.tmp\IPv1D5VMntCqYLG8hxpGSbE7.tmp" /SL5="$900DC,506127,422400,C:\Users\Admin\Pictures\Adobe Films\IPv1D5VMntCqYLG8hxpGSbE7.exe"
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\is-2B51T.tmp\befeduce.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-2B51T.tmp\befeduce.exe" /S /UID=Irecch4
        7⤵
        
        PID:5740
- - C:\Users\Admin\Pictures\Adobe Films\y_vCuk_9JQtIvId56WIBtl4p.exe
    "C:\Users\Admin\Pictures\Adobe Films\y_vCuk_9JQtIvId56WIBtl4p.exe"
    3⤵
    - Executes dropped EXE
    PID:4716
- - C:\Users\Admin\Pictures\Adobe Films\MejHXduk_C40F5teVyTDgpiw.exe
    "C:\Users\Admin\Pictures\Adobe Films\MejHXduk_C40F5teVyTDgpiw.exe"
    3⤵
    PID:1688
- - C:\Users\Admin\Pictures\Adobe Films\ecImIUgkJDSzLI1pkZJd4d20.exe
    "C:\Users\Admin\Pictures\Adobe Films\ecImIUgkJDSzLI1pkZJd4d20.exe"
    3⤵
    PID:5060
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:33376
- - C:\Users\Admin\Pictures\Adobe Films\fgFo0X8JP2Sux215czbNvEz_.exe
    "C:\Users\Admin\Pictures\Adobe Films\fgFo0X8JP2Sux215czbNvEz_.exe"
    3⤵
    PID:1836
- - C:\Users\Admin\Pictures\Adobe Films\ADfLyl1BMhLeR29hyBFIW5eH.exe
    "C:\Users\Admin\Pictures\Adobe Films\ADfLyl1BMhLeR29hyBFIW5eH.exe"
    3⤵
    PID:4080
  - - C:\Users\Admin\Pictures\Adobe Films\ADfLyl1BMhLeR29hyBFIW5eH.exe
      "C:\Users\Admin\Pictures\Adobe Films\ADfLyl1BMhLeR29hyBFIW5eH.exe"
      4⤵
      PID:33608
- - C:\Users\Admin\Pictures\Adobe Films\gMJFk6Ab9EZRoPbNPKm7E7lB.exe
    "C:\Users\Admin\Pictures\Adobe Films\gMJFk6Ab9EZRoPbNPKm7E7lB.exe"
    3⤵
    PID:1404
- - C:\Users\Admin\Pictures\Adobe Films\dKyPTGPxGVYAaCOSnXwNuHsK.exe
    "C:\Users\Admin\Pictures\Adobe Films\dKyPTGPxGVYAaCOSnXwNuHsK.exe"
    3⤵
    PID:2656
- - C:\Users\Admin\Pictures\Adobe Films\v71Y1omkyVbEIM2dwpbWxR6X.exe
    "C:\Users\Admin\Pictures\Adobe Films\v71Y1omkyVbEIM2dwpbWxR6X.exe"
    3⤵
    PID:2616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 452
      4⤵
      Program crash
      PID:20836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 764
      4⤵
      Program crash
      PID:33764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 772
      4⤵
      Program crash
      PID:1860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 792
      4⤵
      Program crash
      PID:808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 804
      4⤵
      Program crash
      PID:5244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 984
      4⤵
      Program crash
      PID:5656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 1012
      4⤵
      Program crash
      PID:6024
- - C:\Users\Admin\Pictures\Adobe Films\fe2NYVF2WefkW4gpVVJeYO7Z.exe
    "C:\Users\Admin\Pictures\Adobe Films\fe2NYVF2WefkW4gpVVJeYO7Z.exe"
    3⤵
    PID:4912
  - - C:\Users\Admin\Pictures\Adobe Films\fe2NYVF2WefkW4gpVVJeYO7Z.exe
      "C:\Users\Admin\Pictures\Adobe Films\fe2NYVF2WefkW4gpVVJeYO7Z.exe"
      4⤵
      PID:19480
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Users\Admin\AppData\Local\96aaa719-cdcc-4ecd-ae3a-63efecde2164" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        5⤵
        Modifies file permissions
        
        PID:33720
    - - C:\Users\Admin\Pictures\Adobe Films\fe2NYVF2WefkW4gpVVJeYO7Z.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\fe2NYVF2WefkW4gpVVJeYO7Z.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        
        PID:3112
      - C:\Users\Admin\Pictures\Adobe Films\fe2NYVF2WefkW4gpVVJeYO7Z.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\fe2NYVF2WefkW4gpVVJeYO7Z.exe" --Admin IsNotAutoStart IsNotTask
        6⤵
        
        PID:5664
- - C:\Users\Admin\Pictures\Adobe Films\Ui7evg_GopgOI1fo0CFADSpx.exe
    "C:\Users\Admin\Pictures\Adobe Films\Ui7evg_GopgOI1fo0CFADSpx.exe"
    3⤵
    PID:2608
- - C:\Users\Admin\Pictures\Adobe Films\31hQt8COjR_FmH0z7frq_H9J.exe
    "C:\Users\Admin\Pictures\Adobe Films\31hQt8COjR_FmH0z7frq_H9J.exe"
    3⤵
    - Executes dropped EXE
    PID:3560
  - - C:\Users\Admin\Pictures\Adobe Films\31hQt8COjR_FmH0z7frq_H9J.exe
      "C:\Users\Admin\Pictures\Adobe Films\31hQt8COjR_FmH0z7frq_H9J.exe"
      4⤵
      PID:260
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im 31hQt8COjR_FmH0z7frq_H9J.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\31hQt8COjR_FmH0z7frq_H9J.exe" & del C:\ProgramData\*.dll & exit
        5⤵
        
        PID:5292
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im 31hQt8COjR_FmH0z7frq_H9J.exe /f
        6⤵
        Kills process with taskkill
        
        PID:5932
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        6⤵
        Delays execution with timeout.exe
        
        PID:6372
- - C:\Users\Admin\Pictures\Adobe Films\ZhVr2NCKQmK0MKuqZXscznFh.exe
    "C:\Users\Admin\Pictures\Adobe Films\ZhVr2NCKQmK0MKuqZXscznFh.exe"
    3⤵
    PID:4524
  - - C:\Users\Admin\Pictures\Adobe Films\ZhVr2NCKQmK0MKuqZXscznFh.exe
      "C:\Users\Admin\Pictures\Adobe Films\ZhVr2NCKQmK0MKuqZXscznFh.exe"
      4⤵
      PID:4240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '"%USERPROFILE%\AppData\Roaming'""
        5⤵
        
        PID:10804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming'"
        6⤵
        
        PID:18308
- - C:\Users\Admin\Pictures\Adobe Films\cYHB_jrkU9v2em9vjKHvky0s.exe
    "C:\Users\Admin\Pictures\Adobe Films\cYHB_jrkU9v2em9vjKHvky0s.exe"
    3⤵
    PID:4452
- - C:\Users\Admin\Pictures\Adobe Films\UJrvV4PJrwA_wM0635DellwA.exe
    "C:\Users\Admin\Pictures\Adobe Films\UJrvV4PJrwA_wM0635DellwA.exe"
    3⤵
    PID:4428
- - C:\Users\Admin\Pictures\Adobe Films\b2RipCTF6iBm1p8BZcmeK5ng.exe
    "C:\Users\Admin\Pictures\Adobe Films\b2RipCTF6iBm1p8BZcmeK5ng.exe"
    3⤵
    PID:4796
  - - C:\Windows\SysWOW64\dllhost.exe
      dllhost kjdlskreshduehfiuwefuihuzhdsfbvnzmnnxcvjkhawiuoyrf8wer847345
      4⤵
      PID:32
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c cmd < Questo.ppt & ping -n 5 localhost
      4⤵
      PID:4292
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        5⤵
        
        PID:19572
- - C:\Users\Admin\Pictures\Adobe Films\riLNl6vXF2uUybpMVjJrbLc6.exe
    "C:\Users\Admin\Pictures\Adobe Films\riLNl6vXF2uUybpMVjJrbLc6.exe"
    3⤵
    PID:328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 772
      4⤵
      Program crash
      PID:5020
- - C:\Users\Admin\Pictures\Adobe Films\6PBkdPRIGjyKoFuzAChIuV9Y.exe
    "C:\Users\Admin\Pictures\Adobe Films\6PBkdPRIGjyKoFuzAChIuV9Y.exe"
    3⤵
    PID:1728
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAAwAA==
      4⤵
      PID:31588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2616 -ip 2616
1⤵
PID:18324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2616 -ip 2616
1⤵
PID:33644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2616 -ip 2616
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 328 -ip 328
1⤵
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2616 -ip 2616
1⤵
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2616 -ip 2616
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5000 -ip 5000
1⤵
PID:5308

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 2292 -ip 2292
1⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2616 -ip 2616
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5000 -ip 5000
1⤵
PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2616 -ip 2616
1⤵
PID:5968

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
1⤵
- Process spawned unexpected child process
PID:6128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
  2⤵
  PID:6152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6152 -s 608
    3⤵
    - Program crash
    PID:6324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5000 -ip 5000
1⤵
PID:6192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6152 -ip 6152
1⤵
PID:6264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery