fabookie | 9265b09595c59007e116c60605c28bd616387cf0dff79c7db8c5880e23cfef8e

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SkVPVS3t6Y8W.EXe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	9265B09595C59007E116C60605C28BD616387CF0DFF79.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	Sat0546bbc15e4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	mshta.exe

Loads dropped DLL 10 IoCs

pid	Process
4980	setup_install.exe
4980	setup_install.exe
4980	setup_install.exe
4980	setup_install.exe
4980	setup_install.exe
4980	setup_install.exe
1544	Sat058b772138cf0f3.tmp
5020	WerFault.exe
828	rundll32.exe
828	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5524-338-0x0000000000740000-0x0000000000D20000-memory.dmp	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json	Sat05ae182be20069e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
145	ipinfo.io
268	ipinfo.io
269	ipinfo.io
19	ip-api.com
144	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2696 set thread context of 444	2696	Sat053bd2e87da.exe	124

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6068	sc.exe
5136	sc.exe
6024	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 17 IoCs

pid	pid_target	Process	procid_target
4680	4980	WerFault.exe	82
636	3520	WerFault.exe	100
4568	3520	WerFault.exe	100
640	3520	WerFault.exe	100
1068	3520	WerFault.exe	100
4280	3520	WerFault.exe	100
4612	3520	WerFault.exe	100
4460	3520	WerFault.exe	100
2348	3520	WerFault.exe	100
3412	3520	WerFault.exe	100
2384	5568	WerFault.exe	192
5480	1184	WerFault.exe	196
4332	5412	WerFault.exe	231
5128	5704	WerFault.exe	184
1524	5160	WerFault.exe	234
4644	3520	WerFault.exe	100
1064	5508	WerFault.exe	183

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat056c52386ee94b16c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat056c52386ee94b16c.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat056c52386ee94b16c.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4520	schtasks.exe
224	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5032	taskkill.exe
4696	taskkill.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	283	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3716	powershell.exe
3716	powershell.exe
3636	Sat056c52386ee94b16c.exe
3636	Sat056c52386ee94b16c.exe
3716	powershell.exe
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found
2732	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3636	Sat056c52386ee94b16c.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	Sat057428ebfd0d.exe
Token: SeCreateTokenPrivilege	3620	Sat05ae182be20069e.exe
Token: SeAssignPrimaryTokenPrivilege	3620	Sat05ae182be20069e.exe
Token: SeLockMemoryPrivilege	3620	Sat05ae182be20069e.exe
Token: SeIncreaseQuotaPrivilege	3620	Sat05ae182be20069e.exe
Token: SeMachineAccountPrivilege	3620	Sat05ae182be20069e.exe
Token: SeTcbPrivilege	3620	Sat05ae182be20069e.exe
Token: SeSecurityPrivilege	3620	Sat05ae182be20069e.exe
Token: SeTakeOwnershipPrivilege	3620	Sat05ae182be20069e.exe
Token: SeLoadDriverPrivilege	3620	Sat05ae182be20069e.exe
Token: SeSystemProfilePrivilege	3620	Sat05ae182be20069e.exe
Token: SeSystemtimePrivilege	3620	Sat05ae182be20069e.exe
Token: SeProfSingleProcessPrivilege	3620	Sat05ae182be20069e.exe
Token: SeIncBasePriorityPrivilege	3620	Sat05ae182be20069e.exe
Token: SeCreatePagefilePrivilege	3620	Sat05ae182be20069e.exe
Token: SeCreatePermanentPrivilege	3620	Sat05ae182be20069e.exe
Token: SeBackupPrivilege	3620	Sat05ae182be20069e.exe
Token: SeRestorePrivilege	3620	Sat05ae182be20069e.exe
Token: SeShutdownPrivilege	3620	Sat05ae182be20069e.exe
Token: SeDebugPrivilege	3620	Sat05ae182be20069e.exe
Token: SeAuditPrivilege	3620	Sat05ae182be20069e.exe
Token: SeSystemEnvironmentPrivilege	3620	Sat05ae182be20069e.exe
Token: SeChangeNotifyPrivilege	3620	Sat05ae182be20069e.exe
Token: SeRemoteShutdownPrivilege	3620	Sat05ae182be20069e.exe
Token: SeUndockPrivilege	3620	Sat05ae182be20069e.exe
Token: SeSyncAgentPrivilege	3620	Sat05ae182be20069e.exe
Token: SeEnableDelegationPrivilege	3620	Sat05ae182be20069e.exe
Token: SeManageVolumePrivilege	3620	Sat05ae182be20069e.exe
Token: SeImpersonatePrivilege	3620	Sat05ae182be20069e.exe
Token: SeCreateGlobalPrivilege	3620	Sat05ae182be20069e.exe
Token: 31	3620	Sat05ae182be20069e.exe
Token: 32	3620	Sat05ae182be20069e.exe
Token: 33	3620	Sat05ae182be20069e.exe
Token: 34	3620	Sat05ae182be20069e.exe
Token: 35	3620	Sat05ae182be20069e.exe
Token: SeDebugPrivilege	3688	Sat05d374c30e.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	4696	taskkill.exe
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found
Token: SeCreatePagefilePrivilege	2732	Process not Found
Token: SeShutdownPrivilege	2732	Process not Found

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2732	Process not Found

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2732	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4980	4564	9265B09595C59007E116C60605C28BD616387CF0DFF79.exe	82
PID 4564 wrote to memory of 4980	4564	9265B09595C59007E116C60605C28BD616387CF0DFF79.exe	82
PID 4564 wrote to memory of 4980	4564	9265B09595C59007E116C60605C28BD616387CF0DFF79.exe	82
PID 4980 wrote to memory of 1844	4980	setup_install.exe	85
PID 4980 wrote to memory of 1844	4980	setup_install.exe	85
PID 4980 wrote to memory of 1844	4980	setup_install.exe	85
PID 4980 wrote to memory of 3108	4980	setup_install.exe	86
PID 4980 wrote to memory of 3108	4980	setup_install.exe	86
PID 4980 wrote to memory of 3108	4980	setup_install.exe	86
PID 4980 wrote to memory of 4624	4980	setup_install.exe	87
PID 4980 wrote to memory of 4624	4980	setup_install.exe	87
PID 4980 wrote to memory of 4624	4980	setup_install.exe	87
PID 4980 wrote to memory of 3792	4980	setup_install.exe	88
PID 4980 wrote to memory of 3792	4980	setup_install.exe	88
PID 4980 wrote to memory of 3792	4980	setup_install.exe	88
PID 4980 wrote to memory of 4368	4980	setup_install.exe	90
PID 4980 wrote to memory of 4368	4980	setup_install.exe	90
PID 4980 wrote to memory of 4368	4980	setup_install.exe	90
PID 4980 wrote to memory of 3464	4980	setup_install.exe	89
PID 4980 wrote to memory of 3464	4980	setup_install.exe	89
PID 4980 wrote to memory of 3464	4980	setup_install.exe	89
PID 4980 wrote to memory of 3304	4980	setup_install.exe	92
PID 4980 wrote to memory of 3304	4980	setup_install.exe	92
PID 4980 wrote to memory of 3304	4980	setup_install.exe	92
PID 4980 wrote to memory of 2344	4980	setup_install.exe	91
PID 4980 wrote to memory of 2344	4980	setup_install.exe	91
PID 4980 wrote to memory of 2344	4980	setup_install.exe	91
PID 3108 wrote to memory of 1480	3108	cmd.exe	114
PID 3108 wrote to memory of 1480	3108	cmd.exe	114
PID 4980 wrote to memory of 4416	4980	setup_install.exe	113
PID 4980 wrote to memory of 4416	4980	setup_install.exe	113
PID 4980 wrote to memory of 4416	4980	setup_install.exe	113
PID 4980 wrote to memory of 3312	4980	setup_install.exe	112
PID 4980 wrote to memory of 3312	4980	setup_install.exe	112
PID 4980 wrote to memory of 3312	4980	setup_install.exe	112
PID 1844 wrote to memory of 3716	1844	cmd.exe	111
PID 1844 wrote to memory of 3716	1844	cmd.exe	111
PID 1844 wrote to memory of 3716	1844	cmd.exe	111
PID 4624 wrote to memory of 2564	4624	cmd.exe	110
PID 4624 wrote to memory of 2564	4624	cmd.exe	110
PID 4624 wrote to memory of 2564	4624	cmd.exe	110
PID 4980 wrote to memory of 3132	4980	setup_install.exe	93
PID 4980 wrote to memory of 3132	4980	setup_install.exe	93
PID 4980 wrote to memory of 3132	4980	setup_install.exe	93
PID 4980 wrote to memory of 1596	4980	setup_install.exe	94
PID 4980 wrote to memory of 1596	4980	setup_install.exe	94
PID 4980 wrote to memory of 1596	4980	setup_install.exe	94
PID 4368 wrote to memory of 3436	4368	cmd.exe	109
PID 4368 wrote to memory of 3436	4368	cmd.exe	109
PID 4368 wrote to memory of 3436	4368	cmd.exe	109
PID 4980 wrote to memory of 204	4980	setup_install.exe	95
PID 4980 wrote to memory of 204	4980	setup_install.exe	95
PID 4980 wrote to memory of 204	4980	setup_install.exe	95
PID 3792 wrote to memory of 2696	3792	cmd.exe	107
PID 3792 wrote to memory of 2696	3792	cmd.exe	107
PID 3792 wrote to memory of 2696	3792	cmd.exe	107
PID 204 wrote to memory of 4004	204	cmd.exe	96
PID 204 wrote to memory of 4004	204	cmd.exe	96
PID 204 wrote to memory of 4004	204	cmd.exe	96
PID 4416 wrote to memory of 3688	4416	cmd.exe	106
PID 4416 wrote to memory of 3688	4416	cmd.exe	106
PID 3304 wrote to memory of 3636	3304	cmd.exe	102
PID 3304 wrote to memory of 3636	3304	cmd.exe	102
PID 3304 wrote to memory of 3636	3304	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\9265B09595C59007E116C60605C28BD616387CF0DFF79.exe
"C:\Users\Admin\AppData\Local\Temp\9265B09595C59007E116C60605C28BD616387CF0DFF79.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat057428ebfd0d.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat057428ebfd0d.exe
      Sat057428ebfd0d.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat053d2789b60d.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat053d2789b60d.exe
      Sat053d2789b60d.exe
      4⤵
      Executes dropped EXE
      PID:2564
    - - C:\Users\Admin\Pictures\Adobe Films\n6Z0Oc9Rk3TA_ATzOzhFLzSJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\n6Z0Oc9Rk3TA_ATzOzhFLzSJ.exe"
        5⤵
        
        PID:5532
      - C:\Windows\Temp\123.exe
        
        "C:\Windows\Temp\123.exe"
        6⤵
        
        PID:1184
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        7⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 140
        7⤵
        Program crash
        
        PID:5480
      - C:\Windows\Temp\321.exe
        
        "C:\Windows\Temp\321.exe"
        6⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
        7⤵
        
        PID:2800
    - - C:\Users\Admin\Pictures\Adobe Films\AuJbri6CT5f25L0l8HN4DYVW.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\AuJbri6CT5f25L0l8HN4DYVW.exe"
        5⤵
        
        PID:5524
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:5296
    - - C:\Users\Admin\Pictures\Adobe Films\5FM3_oIL_1Fsg1meLE3hcwg7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\5FM3_oIL_1Fsg1meLE3hcwg7.exe"
        5⤵
        
        PID:5516
    - - C:\Users\Admin\Pictures\Adobe Films\0lXGbasD6aRq_FUGybrT2N7J.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0lXGbasD6aRq_FUGybrT2N7J.exe"
        5⤵
        
        PID:5500
      - C:\Users\Admin\Pictures\Adobe Films\0lXGbasD6aRq_FUGybrT2N7J.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0lXGbasD6aRq_FUGybrT2N7J.exe" -h
        6⤵
        
        PID:5320
    - - C:\Users\Admin\Pictures\Adobe Films\i7oBK51f_SDaHln6w_1rXGwn.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\i7oBK51f_SDaHln6w_1rXGwn.exe"
        5⤵
        
        PID:5508
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5508 -s 1740
        6⤵
        Program crash
        
        PID:1064
    - - C:\Users\Admin\Pictures\Adobe Films\r3bUMVfvyO_b9u1pL_1oVf2Z.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\r3bUMVfvyO_b9u1pL_1oVf2Z.exe"
        5⤵
        
        PID:5704
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dlwsvsxb\
        6⤵
        
        PID:4776
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\uanibivq.exe" C:\Windows\SysWOW64\dlwsvsxb\
        6⤵
        
        PID:2468
      - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create dlwsvsxb binPath= "C:\Windows\SysWOW64\dlwsvsxb\uanibivq.exe /d\"C:\Users\Admin\Pictures\Adobe Films\r3bUMVfvyO_b9u1pL_1oVf2Z.exe\"" type= own start= auto DisplayName= "wifi support"
        6⤵
        Launches sc.exe
        
        PID:6068
      - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" description dlwsvsxb "wifi internet conection"
        6⤵
        Launches sc.exe
        
        PID:5136
      - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" start dlwsvsxb
        6⤵
        Launches sc.exe
        
        PID:6024
      - C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
        6⤵
        Modifies Windows Firewall
        
        PID:5216
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 1036
        6⤵
        Program crash
        
        PID:5128
    - - C:\Users\Admin\Pictures\Adobe Films\oKWECTsKdCaFblhDtw2283E7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\oKWECTsKdCaFblhDtw2283E7.exe"
        5⤵
        
        PID:5696
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
        6⤵
        
        PID:4100
    - - C:\Users\Admin\Pictures\Adobe Films\QTc4QX67JNFrGai8CPHGlKQs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\QTc4QX67JNFrGai8CPHGlKQs.exe"
        5⤵
        
        PID:5600
      - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" .\A3iLQ0.H2
        6⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\A3iLQ0.H2
        7⤵
        
        PID:3060
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\A3iLQ0.H2
        8⤵
        Blocklisted process makes network request
        
        PID:1564
    - - C:\Users\Admin\Pictures\Adobe Films\_1coOpx3pb15Q0Pd5RXXyx6g.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\_1coOpx3pb15Q0Pd5RXXyx6g.exe"
        5⤵
        
        PID:5592
    - - C:\Users\Admin\Pictures\Adobe Films\xVFWgKCwOlwcSCz573eLUwnZ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\xVFWgKCwOlwcSCz573eLUwnZ.exe"
        5⤵
        
        PID:5584
    - - C:\Users\Admin\Pictures\Adobe Films\RpQnPFMXTyoZOHytnz8J2_tz.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\RpQnPFMXTyoZOHytnz8J2_tz.exe"
        5⤵
        
        PID:5576
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:4520
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:224
    - - C:\Users\Admin\Pictures\Adobe Films\hgoOeZhgiUCvN6YjVDDa2Ngx.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\hgoOeZhgiUCvN6YjVDDa2Ngx.exe"
        5⤵
        
        PID:5568
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        
        PID:4620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 156
        6⤵
        Program crash
        
        PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat053bd2e87da.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat053bd2e87da.exe
      Sat053bd2e87da.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat053bd2e87da.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat053bd2e87da.exe
        5⤵
        Executes dropped EXE
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat053bd2e87da.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat053bd2e87da.exe
        5⤵
        Executes dropped EXE
        
        PID:444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat0556e72238ef5897.exe /mixone
    3⤵
    PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat0556e72238ef5897.exe
      Sat0556e72238ef5897.exe /mixone
      4⤵
      Executes dropped EXE
      PID:3520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 620
        5⤵
        Program crash
        
        PID:636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 624
        5⤵
        Program crash
        
        PID:4568
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 752
        5⤵
        Program crash
        
        PID:640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 784
        5⤵
        Program crash
        
        PID:1068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 852
        5⤵
        Program crash
        
        PID:4280
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 820
        5⤵
        Program crash
        
        PID:4612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1064
        5⤵
        Program crash
        
        PID:4460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1072
        5⤵
        Program crash
        
        PID:2348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1164
        5⤵
        Program crash
        
        PID:3412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 628
        5⤵
        Program crash
        
        PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat05786a45dda23f71f.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat05786a45dda23f71f.exe
      Sat05786a45dda23f71f.exe
      4⤵
      Executes dropped EXE
      PID:3436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat05a28e92796e93d.exe
    3⤵
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat05a28e92796e93d.exe
      Sat05a28e92796e93d.exe
      4⤵
      Executes dropped EXE
      PID:3476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat056c52386ee94b16c.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat056c52386ee94b16c.exe
      Sat056c52386ee94b16c.exe
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat05ae182be20069e.exe
    3⤵
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat05ae182be20069e.exe
      Sat05ae182be20069e.exe
      4⤵
      Executes dropped EXE
      Drops Chrome extension
      Suspicious use of AdjustPrivilegeToken
      PID:3620
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:932
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2392
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff28394f50,0x7fff28394f60,0x7fff28394f70
        6⤵
        
        PID:4208
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1672 /prefetch:2
        6⤵
        
        PID:4708
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1988 /prefetch:8
        6⤵
        
        PID:692
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 /prefetch:8
        6⤵
        
        PID:4680
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2920 /prefetch:1
        6⤵
        
        PID:3628
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
        6⤵
        
        PID:1968
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
        6⤵
        
        PID:856
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4016 /prefetch:8
        6⤵
        
        PID:3912
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:8
        6⤵
        
        PID:1844
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
        6⤵
        
        PID:4316
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5188 /prefetch:8
        6⤵
        
        PID:1504
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5176 /prefetch:8
        6⤵
        
        PID:5152
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
        6⤵
        
        PID:5192
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 /prefetch:8
        6⤵
        
        PID:5644
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
        6⤵
        
        PID:5796
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
        6⤵
        
        PID:5720
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2824 /prefetch:2
        6⤵
        
        PID:5472
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,10643933251871413299,2970555953245434514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1036 /prefetch:8
        6⤵
        
        PID:5956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat058b772138cf0f3.exe
    3⤵
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat058b772138cf0f3.exe
      Sat058b772138cf0f3.exe
      4⤵
      Executes dropped EXE
      PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\is-1V4TA.tmp\Sat058b772138cf0f3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-1V4TA.tmp\Sat058b772138cf0f3.tmp" /SL5="$30188,239846,156160,C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat058b772138cf0f3.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat0546bbc15e4.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat0546bbc15e4.exe
      Sat0546bbc15e4.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:4004
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat0546bbc15e4.exe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat0546bbc15e4.exe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
        5⤵
        Checks computer location settings
        
        PID:1556
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat0546bbc15e4.exe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat0546bbc15e4.exe" ) do taskkill -F -Im "%~nXU"
        6⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe
        
        SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK
        7⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:3876
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""/phmOv~geMVZhd~P51OGqJQYYUK "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
        8⤵
        Checks computer location settings
        
        PID:4744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK "== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" ) do taskkill -F -Im "%~nXU"
        9⤵
        
        PID:564
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBsCRipT:CloSE ( CReaTEoBJEct ( "WSCRIPT.SHElL" ). rUn("cMd /q /C eCHo | SET /P = ""MZ"" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ + 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM & StARt control .\FUEj5.QM " , 0 , tRuE ) )
        8⤵
        Checks computer location settings
        
        PID:3308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM& StARt control .\FUEj5.QM
        9⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHo "
        10⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>yW7bB.DeE"
        10⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\control.exe
        
        control .\FUEj5.QM
        10⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\FUEj5.QM
        11⤵
        
        PID:5020
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\FUEj5.QM
        12⤵
        
        PID:852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\FUEj5.QM
        13⤵
        Loads dropped DLL
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F -Im "Sat0546bbc15e4.exe"
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 588
    3⤵
    - Program crash
    PID:4680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat05ff081f766eeabb8.exe
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat05d374c30e.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4416

C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat05ff081f766eeabb8.exe
Sat05ff081f766eeabb8.exe
1⤵
- Executes dropped EXE
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4980 -ip 4980
1⤵
PID:2244

C:\Users\Admin\AppData\Local\Temp\7zS4D18DB76\Sat05d374c30e.exe
Sat05d374c30e.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3520 -ip 3520
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3520 -ip 3520
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3520 -ip 3520
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3520 -ip 3520
1⤵
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3520 -ip 3520
1⤵
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3520 -ip 3520
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3520 -ip 3520
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3520 -ip 3520
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3520 -ip 3520
1⤵
- Loads dropped DLL
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5568 -ip 5568
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1184 -ip 1184
1⤵
PID:5368

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:3092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  PID:5412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 600
    3⤵
    - Program crash
    PID:4332

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\A3iLQ0.H2
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5412 -ip 5412
1⤵
PID:5652

C:\Windows\SysWOW64\dlwsvsxb\uanibivq.exe
C:\Windows\SysWOW64\dlwsvsxb\uanibivq.exe /d"C:\Users\Admin\Pictures\Adobe Films\r3bUMVfvyO_b9u1pL_1oVf2Z.exe"
1⤵
PID:5160
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:5304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 512
  2⤵
  - Program crash
  PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5704 -ip 5704
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5160 -ip 5160
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3520 -ip 3520
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5508 -ip 5508
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Modify Existing Service

T1031

New Service

T1050

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Scripting

T1064

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery