djvu | e8e4a4c7c5c593136058722cabe2d42631feffde95d923f5fd7020b0c7286f22

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	File.exe

ModiLoader Second Stage 39 IoCs

resource	yara_rule
behavioral2/memory/1264-145-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-146-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-147-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-148-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-150-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-149-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-151-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-152-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-153-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-154-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-155-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-156-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-158-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-159-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-160-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-157-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-161-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-162-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-163-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-164-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-165-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-166-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-167-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-169-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-170-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-168-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-174-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-175-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-176-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-178-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-177-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-185-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-186-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-187-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-188-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-189-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-190-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-191-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2
behavioral2/memory/1264-192-0x00000000075A0000-0x00000000075FB000-memory.dmp	modiloader_stage2

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/4556-280-0x0000000002690000-0x00000000026DF000-memory.dmp	family_vidar
behavioral2/memory/676-289-0x0000000000EE0000-0x0000000000F2F000-memory.dmp	family_vidar
behavioral2/memory/4556-282-0x0000000000400000-0x0000000000B58000-memory.dmp	family_vidar
behavioral2/memory/676-295-0x0000000000400000-0x0000000000B58000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
4556	zCHcFiCyvvhppQDwEtlSneV1.exe
4876	e5aHGgFTDeCHUmzBXoCA8L25.exe
2628	jCe3XF_imYtBCU3cZq7xtffT.exe
4004	BaG2BELvZmH2rXbHdS1hINP7.exe
2832	_JnOElxKQP8lX1dE20XoBPaW.exe
1892	MgIxPLDf_FApTujRPgTfI2Tr.exe
4052	3JZgQG6AizVAy_0V0XxrzQwk.exe
3968	4IrUI8ddFL0CcXYNUmOEiHpW.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e4e-217.dat	upx
behavioral2/files/0x0006000000022e4e-218.dat	upx
behavioral2/memory/4004-239-0x0000000000400000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/4004-315-0x0000000000400000-0x0000000000C96000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	File.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	File.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	File.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4084	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/1264-130-0x0000000000DE0000-0x000000000114D000-memory.dmp	themida
behavioral2/memory/1264-131-0x0000000000DE0000-0x000000000114D000-memory.dmp	themida
behavioral2/memory/1264-134-0x0000000000DE0000-0x000000000114D000-memory.dmp	themida
behavioral2/memory/1264-193-0x0000000000DE0000-0x000000000114D000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	File.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	ipinfo.io
134	ipinfo.io
135	ipinfo.io
152	api.2ip.ua
153	api.2ip.ua
164	ipinfo.io
43	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1264	File.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4768	4028	WerFault.exe	101
4588	4028	WerFault.exe	101
2028	4028	WerFault.exe	101

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3248	schtasks.exe
60	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1264	File.exe
1264	File.exe
4696	File.exe
4696	File.exe
4696	File.exe
4696	File.exe
4696	File.exe
4696	File.exe
4696	File.exe
4696	File.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe
3952	8sOgj6Udi8T35OVDU4VHZN7G.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89
PID 1264 wrote to memory of 4696	1264	File.exe	89

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2268	attrib.exe

C:\Users\Admin\AppData\Local\Temp\File.exe
"C:\Users\Admin\AppData\Local\Temp\File.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\File.exe
  C:\Users\Admin\AppData\Local\Temp\File.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- - C:\Users\Admin\Pictures\Adobe Films\8sOgj6Udi8T35OVDU4VHZN7G.exe
    "C:\Users\Admin\Pictures\Adobe Films\8sOgj6Udi8T35OVDU4VHZN7G.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3952
- - C:\Users\Admin\Pictures\Adobe Films\zCHcFiCyvvhppQDwEtlSneV1.exe
    "C:\Users\Admin\Pictures\Adobe Films\zCHcFiCyvvhppQDwEtlSneV1.exe"
    3⤵
    - Executes dropped EXE
    PID:4556
- - C:\Users\Admin\Pictures\Adobe Films\e5aHGgFTDeCHUmzBXoCA8L25.exe
    "C:\Users\Admin\Pictures\Adobe Films\e5aHGgFTDeCHUmzBXoCA8L25.exe"
    3⤵
    - Executes dropped EXE
    PID:4876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -?
      4⤵
      Views/modifies file attributes
      PID:2268
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c cmd < Inebriarti.htm & ping -n 5 localhost
      4⤵
      PID:4960
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        5⤵
        
        PID:3948
- - C:\Users\Admin\Pictures\Adobe Films\jCe3XF_imYtBCU3cZq7xtffT.exe
    "C:\Users\Admin\Pictures\Adobe Films\jCe3XF_imYtBCU3cZq7xtffT.exe"
    3⤵
    - Executes dropped EXE
    PID:2628
  - - C:\Users\Admin\Documents\kW4IzdjojsKFhHrfbkrJFbiS.exe
      "C:\Users\Admin\Documents\kW4IzdjojsKFhHrfbkrJFbiS.exe"
      4⤵
      PID:2316
    - - C:\Users\Admin\Pictures\Adobe Films\UWREBSPUqjOmLpo534quQgwm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UWREBSPUqjOmLpo534quQgwm.exe"
        5⤵
        
        PID:428
    - - C:\Users\Admin\Pictures\Adobe Films\B9hIE_vIiOgTbJFPcV1h6f3z.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\B9hIE_vIiOgTbJFPcV1h6f3z.exe"
        5⤵
        
        PID:3708
    - - C:\Users\Admin\Pictures\Adobe Films\asZMNKLQF9b8jijyDmHTGXMs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\asZMNKLQF9b8jijyDmHTGXMs.exe"
        5⤵
        
        PID:3752
    - - C:\Users\Admin\Pictures\Adobe Films\wCnkpxkGS0IwjPuYaVAiWG4B.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\wCnkpxkGS0IwjPuYaVAiWG4B.exe"
        5⤵
        
        PID:4760
    - - C:\Users\Admin\Pictures\Adobe Films\JpPSO04cphpQvYXYxxdtnO_G.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\JpPSO04cphpQvYXYxxdtnO_G.exe"
        5⤵
        
        PID:1660
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3248
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:60
- - C:\Users\Admin\Pictures\Adobe Films\BaG2BELvZmH2rXbHdS1hINP7.exe
    "C:\Users\Admin\Pictures\Adobe Films\BaG2BELvZmH2rXbHdS1hINP7.exe"
    3⤵
    - Executes dropped EXE
    PID:4004
- - C:\Users\Admin\Pictures\Adobe Films\4IrUI8ddFL0CcXYNUmOEiHpW.exe
    "C:\Users\Admin\Pictures\Adobe Films\4IrUI8ddFL0CcXYNUmOEiHpW.exe"
    3⤵
    - Executes dropped EXE
    PID:3968
  - - C:\Users\Admin\Pictures\Adobe Films\4IrUI8ddFL0CcXYNUmOEiHpW.exe
      "C:\Users\Admin\Pictures\Adobe Films\4IrUI8ddFL0CcXYNUmOEiHpW.exe"
      4⤵
      PID:3372
- - C:\Users\Admin\Pictures\Adobe Films\3JZgQG6AizVAy_0V0XxrzQwk.exe
    "C:\Users\Admin\Pictures\Adobe Films\3JZgQG6AizVAy_0V0XxrzQwk.exe"
    3⤵
    - Executes dropped EXE
    PID:4052
  - - C:\Users\Admin\Pictures\Adobe Films\3JZgQG6AizVAy_0V0XxrzQwk.exe
      "C:\Users\Admin\Pictures\Adobe Films\3JZgQG6AizVAy_0V0XxrzQwk.exe"
      4⤵
      PID:1972
- - C:\Users\Admin\Pictures\Adobe Films\_JnOElxKQP8lX1dE20XoBPaW.exe
    "C:\Users\Admin\Pictures\Adobe Films\_JnOElxKQP8lX1dE20XoBPaW.exe"
    3⤵
    - Executes dropped EXE
    PID:2832
  - - C:\Users\Admin\Pictures\Adobe Films\_JnOElxKQP8lX1dE20XoBPaW.exe
      "C:\Users\Admin\Pictures\Adobe Films\_JnOElxKQP8lX1dE20XoBPaW.exe"
      4⤵
      PID:4632
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Users\Admin\AppData\Local\2f093158-763e-4ddc-a344-d1e89eb4c13c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        5⤵
        Modifies file permissions
        
        PID:4084
- - C:\Users\Admin\Pictures\Adobe Films\MgIxPLDf_FApTujRPgTfI2Tr.exe
    "C:\Users\Admin\Pictures\Adobe Films\MgIxPLDf_FApTujRPgTfI2Tr.exe"
    3⤵
    - Executes dropped EXE
    PID:1892
- - C:\Users\Admin\Pictures\Adobe Films\5SqvUvwMPpwFLjRi7mPROYYj.exe
    "C:\Users\Admin\Pictures\Adobe Films\5SqvUvwMPpwFLjRi7mPROYYj.exe"
    3⤵
    PID:5100
- - C:\Users\Admin\Pictures\Adobe Films\FVjpZzZUBIM4ZGuza0nhI8Cz.exe
    "C:\Users\Admin\Pictures\Adobe Films\FVjpZzZUBIM4ZGuza0nhI8Cz.exe"
    3⤵
    PID:676
- - C:\Users\Admin\Pictures\Adobe Films\HFinnqbB2rmY7iFStElsAgNT.exe
    "C:\Users\Admin\Pictures\Adobe Films\HFinnqbB2rmY7iFStElsAgNT.exe"
    3⤵
    PID:4028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 452
      4⤵
      Program crash
      PID:4768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 764
      4⤵
      Program crash
      PID:4588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 772
      4⤵
      Program crash
      PID:2028
- - C:\Users\Admin\Pictures\Adobe Films\gaZYCljYysiTyYEMq4mrcQbi.exe
    "C:\Users\Admin\Pictures\Adobe Films\gaZYCljYysiTyYEMq4mrcQbi.exe"
    3⤵
    PID:3820
- - C:\Users\Admin\Pictures\Adobe Films\ZM9TLO1_fMpR9KNFViBnu57U.exe
    "C:\Users\Admin\Pictures\Adobe Films\ZM9TLO1_fMpR9KNFViBnu57U.exe"
    3⤵
    PID:4452
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAAwAA==
      4⤵
      PID:1216
- - C:\Users\Admin\Pictures\Adobe Films\LogMeesdQFLE75EWQ1FdKCGf.exe
    "C:\Users\Admin\Pictures\Adobe Films\LogMeesdQFLE75EWQ1FdKCGf.exe"
    3⤵
    PID:5020
- - C:\Users\Admin\Pictures\Adobe Films\KMAwpGzjwOfECWF5TKb9WVPr.exe
    "C:\Users\Admin\Pictures\Adobe Films\KMAwpGzjwOfECWF5TKb9WVPr.exe"
    3⤵
    PID:4340
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -U /s m4zdVOdJ.PY7
      4⤵
      PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4028 -ip 4028
1⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4028 -ip 4028
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4028 -ip 4028
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4028 -ip 4028
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery