hxxp://tlniurl[.]com/1x3i1x

General

Target

http://tlniurl.com/1x3i1x

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

Sony-Vegas-Pro-Crack_NQ5vYOZD.exeis-CIEKD.tmpAbrielMyFilesPro.exeAbrielMyFilesPro.exe

pid process

4496 Sony-Vegas-Pro-Crack_NQ5vYOZD.exe
1368 is-CIEKD.tmp
4192 AbrielMyFilesPro.exe
4488 AbrielMyFilesPro.exe
Loads dropped DLL 1 IoCs

Processes:

is-CIEKD.tmp

pid process

1368 is-CIEKD.tmp

pid	process
4496	Sony-Vegas-Pro-Crack_NQ5vYOZD.exe
1368	is-CIEKD.tmp
4192	AbrielMyFilesPro.exe
4488	AbrielMyFilesPro.exe

pid	process
1368	is-CIEKD.tmp

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1063

Processes:

AbrielMyFilesPro.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop\Build	AbrielMyFilesPro.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop\Build	AbrielMyFilesPro.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop	AbrielMyFilesPro.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop	AbrielMyFilesPro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

Processes:

is-CIEKD.tmp

description	ioc	process
File created	C:\Program Files (x86)\AbrielFilesPro\unins000.dat	is-CIEKD.tmp
File created	C:\Program Files (x86)\AbrielFilesPro\is-SFJHH.tmp	is-CIEKD.tmp
File created	C:\Program Files (x86)\AbrielFilesPro\is-0MJCR.tmp	is-CIEKD.tmp
File created	C:\Program Files (x86)\AbrielFilesPro\is-QP5IJ.tmp	is-CIEKD.tmp
File created	C:\Program Files (x86)\AbrielFilesPro\is-Q971L.tmp	is-CIEKD.tmp
File created	C:\Program Files (x86)\AbrielFilesPro\is-63N85.tmp	is-CIEKD.tmp
File opened for modification	C:\Program Files (x86)\AbrielFilesPro\unins000.dat	is-CIEKD.tmp
File opened for modification	C:\Program Files (x86)\AbrielFilesPro\AbrielMyFilesPro.exe	is-CIEKD.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 19 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4796	4192	WerFault.exe	AbrielMyFilesPro.exe
4084	4192	WerFault.exe	AbrielMyFilesPro.exe
3876	4192	WerFault.exe	AbrielMyFilesPro.exe
2296	4488	WerFault.exe	AbrielMyFilesPro.exe
3812	4488	WerFault.exe	AbrielMyFilesPro.exe
4820	4488	WerFault.exe	AbrielMyFilesPro.exe
3528	4488	WerFault.exe	AbrielMyFilesPro.exe
1708	4488	WerFault.exe	AbrielMyFilesPro.exe
4080	4488	WerFault.exe	AbrielMyFilesPro.exe
2408	4488	WerFault.exe	AbrielMyFilesPro.exe
3152	4488	WerFault.exe	AbrielMyFilesPro.exe
392	4488	WerFault.exe	AbrielMyFilesPro.exe
5104	4488	WerFault.exe	AbrielMyFilesPro.exe
424	4488	WerFault.exe	AbrielMyFilesPro.exe
1716	4488	WerFault.exe	AbrielMyFilesPro.exe
4272	4488	WerFault.exe	AbrielMyFilesPro.exe
1500	4488	WerFault.exe	AbrielMyFilesPro.exe
676	4488	WerFault.exe	AbrielMyFilesPro.exe
3936	4488	WerFault.exe	AbrielMyFilesPro.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000_Classes\Local Settings firefox.exe
NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Sony-Vegas-Pro-Crack_NQ5vYOZD.exe:Zone.Identifier firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000_Classes\Local Settings	firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Sony-Vegas-Pro-Crack_NQ5vYOZD.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

AbrielMyFilesPro.exetaskmgr.exe

pid	process
4488	AbrielMyFilesPro.exe
4488	AbrielMyFilesPro.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

firefox.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	3172	firefox.exe
Token: SeDebugPrivilege	3172	firefox.exe
Token: SeDebugPrivilege	4508	taskmgr.exe
Token: SeSystemProfilePrivilege	4508	taskmgr.exe
Token: SeCreateGlobalPrivilege	4508	taskmgr.exe
Token: 33	4508	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4508	taskmgr.exe

Suspicious use of FindShellTrayWindow 44 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
3172	firefox.exe
3172	firefox.exe
3172	firefox.exe
3172	firefox.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe

Suspicious use of SendNotifyMessage 42 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
3172	firefox.exe
3172	firefox.exe
3172	firefox.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe
4508	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

firefox.exe

pid process

3172 firefox.exe
3172 firefox.exe
3172 firefox.exe
3172 firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2316 wrote to memory of 3172	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 3172	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 3172	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 3172	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 3172	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 3172	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 3172	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 3172	2316	firefox.exe	firefox.exe
PID 2316 wrote to memory of 3172	2316	firefox.exe	firefox.exe
PID 3172 wrote to memory of 2076	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 2076	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 4124	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 424	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 424	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 424	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 424	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 424	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 424	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 424	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 424	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 424	3172	firefox.exe	firefox.exe
PID 3172 wrote to memory of 424	3172	firefox.exe	firefox.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" http://tlniurl.com/1x3i1x
1⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" http://tlniurl.com/1x3i1x
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3172.0.1686592124\627402291" -parentBuildID 20200403170909 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 1 -prefMapSize 220073 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3172 "\\.\pipe\gecko-crash-server-pipe.3172" 1780 gpu
3⤵
PID:2076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3172.3.1872863328\2141733972" -childID 1 -isForBrowser -prefsHandle 2484 -prefMapHandle 1564 -prefsLen 78 -prefMapSize 220073 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3172 "\\.\pipe\gecko-crash-server-pipe.3172" 2472 tab
3⤵
PID:4124

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3172.13.216973103\86702932" -childID 2 -isForBrowser -prefsHandle 3588 -prefMapHandle 3584 -prefsLen 6860 -prefMapSize 220073 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3172 "\\.\pipe\gecko-crash-server-pipe.3172" 3600 tab
3⤵
PID:424

C:\Users\Admin\Downloads\Sony-Vegas-Pro-Crack_NQ5vYOZD.exe
"C:\Users\Admin\Downloads\Sony-Vegas-Pro-Crack_NQ5vYOZD.exe"
1⤵
- Executes dropped EXE
PID:4496

C:\Users\Admin\AppData\Local\Temp\is-TN80H.tmp\is-CIEKD.tmp
"C:\Users\Admin\AppData\Local\Temp\is-TN80H.tmp\is-CIEKD.tmp" /SL4 $1020A "C:\Users\Admin\Downloads\Sony-Vegas-Pro-Crack_NQ5vYOZD.exe" 3802872 93184
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1368

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Query
3⤵
PID:4228

C:\Program Files (x86)\AbrielFilesPro\AbrielMyFilesPro.exe
"C:\Program Files (x86)\AbrielFilesPro\AbrielMyFilesPro.exe"
3⤵
- Executes dropped EXE
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1044
4⤵
- Program crash
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1080
4⤵
- Program crash
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 140
4⤵
- Program crash
PID:3876

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /F /TN "UndeleteMyFiles Pro 32"
3⤵
PID:980

C:\Program Files (x86)\AbrielFilesPro\AbrielMyFilesPro.exe
"C:\Program Files (x86)\AbrielFilesPro\AbrielMyFilesPro.exe" 30b770fda09f718acf34258e00e7d06b
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1028
4⤵
- Program crash
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1036
4⤵
- Program crash
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1120
4⤵
- Program crash
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1216
4⤵
- Program crash
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1264
4⤵
- Program crash
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1324
4⤵
- Program crash
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1332
4⤵
- Program crash
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1392
4⤵
- Program crash
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1324
4⤵
- Program crash
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1396
4⤵
- Program crash
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1144
4⤵
- Program crash
PID:424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1520
4⤵
- Program crash
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1396
4⤵
- Program crash
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1128
4⤵
- Program crash
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1144
4⤵
- Program crash
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 140
4⤵
- Program crash
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4192 -ip 4192
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4192 -ip 4192
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4192 -ip 4192
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4488 -ip 4488
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4488 -ip 4488
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4488 -ip 4488
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4488 -ip 4488
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4488 -ip 4488
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4488 -ip 4488
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4488 -ip 4488
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4488 -ip 4488
1⤵
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4488 -ip 4488
1⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4488 -ip 4488
1⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4488 -ip 4488
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4488 -ip 4488
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4488 -ip 4488
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4488 -ip 4488
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4488 -ip 4488
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4488 -ip 4488
1⤵
PID:3608

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Security Software Discovery

1

T1063

Query Registry

3

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\AbrielFilesPro\AbrielMyFilesPro.exe
Filesize
4.7MB

MD5
ee257b83012f64e13dbd9ecff70884cc

SHA1
d9ab7f6fe46f5d44a5172c7b7d6a58d5ac875b12

SHA256
f9eb99b1de309353abd7a2e53f562c3658da580701a8115e8c65e7bf6a5211fb

SHA512
2dd559b42ae540140dcb0dff583472217f360aeae22c4528d04aeedbf1be1c3e6f4ae2164a649504ebaa8f5944469e22af70406f1744d83ec1a5e22573094a52

Download Submit
C:\Program Files (x86)\AbrielFilesPro\AbrielMyFilesPro.exe
Filesize
4.7MB

MD5
ee257b83012f64e13dbd9ecff70884cc

SHA1
d9ab7f6fe46f5d44a5172c7b7d6a58d5ac875b12

SHA256
f9eb99b1de309353abd7a2e53f562c3658da580701a8115e8c65e7bf6a5211fb

SHA512
2dd559b42ae540140dcb0dff583472217f360aeae22c4528d04aeedbf1be1c3e6f4ae2164a649504ebaa8f5944469e22af70406f1744d83ec1a5e22573094a52

Download Submit
C:\Program Files (x86)\AbrielFilesPro\AbrielMyFilesPro.exe
Filesize
4.7MB

MD5
ee257b83012f64e13dbd9ecff70884cc

SHA1
d9ab7f6fe46f5d44a5172c7b7d6a58d5ac875b12

SHA256
f9eb99b1de309353abd7a2e53f562c3658da580701a8115e8c65e7bf6a5211fb

SHA512
2dd559b42ae540140dcb0dff583472217f360aeae22c4528d04aeedbf1be1c3e6f4ae2164a649504ebaa8f5944469e22af70406f1744d83ec1a5e22573094a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MFU84.tmp\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TN80H.tmp\is-CIEKD.tmp
Filesize
685KB

MD5
7f46188bafe719b5ba8e32c2e0037f21

SHA1
6dc19d768f6b24766cfcdf49f630b517174c780e

SHA256
3c65b17529d5a22bbcb9f726f567f3a0506f6536bc5048789fd2f11c420ffd5e

SHA512
5c14cf51850c1e02765e86f7a166e7554425c3399e979ff75397a1c430e1c5099545eddd51e65b06790fb3cc9cbb70b70749438ec3277deba5a0eb4c3beb2bc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TN80H.tmp\is-CIEKD.tmp
Filesize
685KB

MD5
7f46188bafe719b5ba8e32c2e0037f21

SHA1
6dc19d768f6b24766cfcdf49f630b517174c780e

SHA256
3c65b17529d5a22bbcb9f726f567f3a0506f6536bc5048789fd2f11c420ffd5e

SHA512
5c14cf51850c1e02765e86f7a166e7554425c3399e979ff75397a1c430e1c5099545eddd51e65b06790fb3cc9cbb70b70749438ec3277deba5a0eb4c3beb2bc3

Download Submit
C:\Users\Admin\Downloads\Sony-Vegas-Pro-Crack_NQ5vYOZD.exe
Filesize
3.9MB

MD5
cda249aa09d54ed57a8b845391fd0298

SHA1
6266ceacbf9300b92343b7c96b1b3593591e2f0e

SHA256
9eb38fb80e816722e45bfad342244e03164703caf535209ad8c570f336bb020a

SHA512
41c0497f1145c14cd2382a75a2b8d91cb1b89f2356b936ddf849d92e51a0dd8a7b9d3d810569a74100985f1329c2fba50ac986754649310ed30818ae2a9e99fc

Download Submit
C:\Users\Admin\Downloads\Sony-Vegas-Pro-Crack_NQ5vYOZD.exe
Filesize
3.9MB

MD5
cda249aa09d54ed57a8b845391fd0298

SHA1
6266ceacbf9300b92343b7c96b1b3593591e2f0e

SHA256
9eb38fb80e816722e45bfad342244e03164703caf535209ad8c570f336bb020a

SHA512
41c0497f1145c14cd2382a75a2b8d91cb1b89f2356b936ddf849d92e51a0dd8a7b9d3d810569a74100985f1329c2fba50ac986754649310ed30818ae2a9e99fc

Download Submit
memory/980-150-0x0000000000000000-mapping.dmp

Download
memory/1368-137-0x0000000000000000-mapping.dmp

Download
memory/4192-149-0x0000000000400000-0x00000000016BC000-memory.dmp

Filesize
18.7MB

Download
memory/4192-143-0x0000000000000000-mapping.dmp

Download
memory/4192-146-0x0000000000400000-0x00000000016BC000-memory.dmp

Filesize
18.7MB

Download
memory/4192-147-0x0000000000400000-0x00000000016BC000-memory.dmp

Filesize
18.7MB

Download
memory/4192-148-0x0000000000400000-0x00000000016BC000-memory.dmp

Filesize
18.7MB

Download
memory/4228-142-0x0000000000000000-mapping.dmp

Download
memory/4488-155-0x0000000000400000-0x00000000016BC000-memory.dmp

Filesize
18.7MB

Download
memory/4488-151-0x0000000000000000-mapping.dmp

Download
memory/4488-153-0x0000000000400000-0x00000000016BC000-memory.dmp

Filesize
18.7MB

Download
memory/4488-156-0x0000000000400000-0x00000000016BC000-memory.dmp

Filesize
18.7MB

Download
memory/4488-157-0x0000000000400000-0x00000000016BC000-memory.dmp

Filesize
18.7MB

Download
memory/4488-158-0x0000000000400000-0x00000000016BC000-memory.dmp

Filesize
18.7MB

Download
memory/4496-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4496-136-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4496-141-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4496-159-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads