amadey | 391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amadka.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amadka.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amadka.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe

Executes dropped EXE 9 IoCs

pid	Process
224	explorgu.exe
2080	random.exe
2772	alex1234.exe
3108	Traffic.exe
3380	propro.exe
2200	amadka.exe
2404	redlinepanel.exe
4188	32456.exe
2936	goldprimeldlldf.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Wine	391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe
Key opened	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Wine	amadka.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Microsoft\Windows\CurrentVersion\Run\random.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000873001\\random.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Microsoft\Windows\CurrentVersion\Run\amadka.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001031001\\amadka.exe"	explorgu.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
17	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
60	api.myip.com
61	ipinfo.io
4	ipinfo.io
37	api.myip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4896	391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe
224	explorgu.exe
2200	amadka.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2772 set thread context of 1236	2772	alex1234.exe	85

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe
File created	C:\Windows\Tasks\explorha.job	amadka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1440	4320	WerFault.exe	102
5292	1604	WerFault.exe	115
1576	3100	WerFault.exe	119

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4712	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	propro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	propro.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
348	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4896	391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe
4896	391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe
224	explorgu.exe
224	explorgu.exe
2200	amadka.exe
2200	amadka.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3108	Traffic.exe
Token: SeBackupPrivilege	3108	Traffic.exe
Token: SeSecurityPrivilege	3108	Traffic.exe
Token: SeSecurityPrivilege	3108	Traffic.exe
Token: SeSecurityPrivilege	3108	Traffic.exe
Token: SeSecurityPrivilege	3108	Traffic.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4896	391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe
2200	amadka.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2080	224	explorgu.exe	82
PID 224 wrote to memory of 2080	224	explorgu.exe	82
PID 224 wrote to memory of 2080	224	explorgu.exe	82
PID 224 wrote to memory of 2772	224	explorgu.exe	83
PID 224 wrote to memory of 2772	224	explorgu.exe	83
PID 224 wrote to memory of 2772	224	explorgu.exe	83
PID 2772 wrote to memory of 1236	2772	alex1234.exe	85
PID 2772 wrote to memory of 1236	2772	alex1234.exe	85
PID 2772 wrote to memory of 1236	2772	alex1234.exe	85
PID 2772 wrote to memory of 1236	2772	alex1234.exe	85
PID 2772 wrote to memory of 1236	2772	alex1234.exe	85
PID 2772 wrote to memory of 1236	2772	alex1234.exe	85
PID 2772 wrote to memory of 1236	2772	alex1234.exe	85
PID 2772 wrote to memory of 1236	2772	alex1234.exe	85
PID 1236 wrote to memory of 3108	1236	RegAsm.exe	86
PID 1236 wrote to memory of 3108	1236	RegAsm.exe	86
PID 1236 wrote to memory of 3380	1236	RegAsm.exe	87
PID 1236 wrote to memory of 3380	1236	RegAsm.exe	87
PID 1236 wrote to memory of 3380	1236	RegAsm.exe	87
PID 224 wrote to memory of 2200	224	explorgu.exe	90
PID 224 wrote to memory of 2200	224	explorgu.exe	90
PID 224 wrote to memory of 2200	224	explorgu.exe	90
PID 224 wrote to memory of 2404	224	explorgu.exe	91
PID 224 wrote to memory of 2404	224	explorgu.exe	91
PID 224 wrote to memory of 2404	224	explorgu.exe	91
PID 224 wrote to memory of 4188	224	explorgu.exe	92
PID 224 wrote to memory of 4188	224	explorgu.exe	92
PID 224 wrote to memory of 2936	224	explorgu.exe	94
PID 224 wrote to memory of 2936	224	explorgu.exe	94
PID 224 wrote to memory of 2936	224	explorgu.exe	94

C:\Users\Admin\AppData\Local\Temp\391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe
"C:\Users\Admin\AppData\Local\Temp\391f39bdcfdfe0268d7dff1e1d8aa622eb14cbfe6858a9e6692e71670958c502.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4896

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
  "C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  PID:2080
- C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
  "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3108
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      PID:3380
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:5652
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:688
- C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
  "C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:2200
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    PID:3880
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      PID:2476
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        5⤵
        
        PID:2276
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        
        PID:2672
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\271347359027_Desktop.zip' -CompressionLevel Optimal
        6⤵
        
        PID:5636
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
      4⤵
      PID:5508
- C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
  "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
  "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
  "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
  2⤵
  - Executes dropped EXE
  PID:2936
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4044
- C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe
    "C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe"
    3⤵
    PID:4576
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:3416
    - - C:\Users\Admin\Pictures\k3xPniukdsGkT9SYxDKF47uq.exe
        
        "C:\Users\Admin\Pictures\k3xPniukdsGkT9SYxDKF47uq.exe"
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\u18k.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u18k.0.exe"
        6⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CGIJJKEHCA.exe"
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\CGIJJKEHCA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CGIJJKEHCA.exe"
        8⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\CGIJJKEHCA.exe
        9⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        10⤵
        Runs ping.exe
        
        PID:348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 3404
        7⤵
        Program crash
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\u18k.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u18k.1.exe"
        6⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        7⤵
        
        PID:2940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 1576
        6⤵
        Program crash
        
        PID:5292
    - - C:\Users\Admin\Pictures\GLnSPY6wAdzkkAnwbvaJ2wRH.exe
        
        "C:\Users\Admin\Pictures\GLnSPY6wAdzkkAnwbvaJ2wRH.exe"
        5⤵
        
        PID:2428
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:3960
      - C:\Users\Admin\Pictures\GLnSPY6wAdzkkAnwbvaJ2wRH.exe
        
        "C:\Users\Admin\Pictures\GLnSPY6wAdzkkAnwbvaJ2wRH.exe"
        6⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:4504
    - - C:\Users\Admin\Pictures\hUkX2tzCHCjjRxo2BWKtX9SD.exe
        
        "C:\Users\Admin\Pictures\hUkX2tzCHCjjRxo2BWKtX9SD.exe"
        5⤵
        
        PID:1440
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:3472
      - C:\Users\Admin\Pictures\hUkX2tzCHCjjRxo2BWKtX9SD.exe
        
        "C:\Users\Admin\Pictures\hUkX2tzCHCjjRxo2BWKtX9SD.exe"
        6⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:5852
    - - C:\Users\Admin\Pictures\49Cg2gItbw7NyR7t1yTjFkNp.exe
        
        "C:\Users\Admin\Pictures\49Cg2gItbw7NyR7t1yTjFkNp.exe"
        5⤵
        
        PID:968
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5948
      - C:\Users\Admin\Pictures\49Cg2gItbw7NyR7t1yTjFkNp.exe
        
        "C:\Users\Admin\Pictures\49Cg2gItbw7NyR7t1yTjFkNp.exe"
        6⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:2368
    - - C:\Users\Admin\Pictures\IxLwLDktVYaNO3hJUslW6l56.exe
        
        "C:\Users\Admin\Pictures\IxLwLDktVYaNO3hJUslW6l56.exe"
        5⤵
        
        PID:244
    - - C:\Users\Admin\Pictures\j3jU3v4Grhu1cwspi7TwW2jz.exe
        
        "C:\Users\Admin\Pictures\j3jU3v4Grhu1cwspi7TwW2jz.exe" --silent --allusers=0
        5⤵
        
        PID:3856
      - C:\Users\Admin\Pictures\j3jU3v4Grhu1cwspi7TwW2jz.exe
        
        C:\Users\Admin\Pictures\j3jU3v4Grhu1cwspi7TwW2jz.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x2c8,0x6ba8e1d0,0x6ba8e1dc,0x6ba8e1e8
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\j3jU3v4Grhu1cwspi7TwW2jz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\j3jU3v4Grhu1cwspi7TwW2jz.exe" --version
        6⤵
        
        PID:5336
      - C:\Users\Admin\Pictures\j3jU3v4Grhu1cwspi7TwW2jz.exe
        
        "C:\Users\Admin\Pictures\j3jU3v4Grhu1cwspi7TwW2jz.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3856 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240331155147" --session-guid=63aa8921-c4a2-46c6-93b5-2366ca9ca54f --server-tracking-blob=NDA4NjQyMjU0N2NiOTU0Nzk5YmNkMzk5OGUwYmI4MjRjN2Q0ZWM2NDJhY2E2OWE0MzViYTJmMjQ5NjEwNmNkNDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N18xMjMiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE5MDAyOTYuMzU3MyIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N18xMjMiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6ImZlNmU3ZWU4LTJlZmEtNDc4NC1hYzgzLTBjZTY0ZjkzYTdmZiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=8005000000000000
        6⤵
        
        PID:5592
        
        C:\Users\Admin\Pictures\j3jU3v4Grhu1cwspi7TwW2jz.exe
        
        C:\Users\Admin\Pictures\j3jU3v4Grhu1cwspi7TwW2jz.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2c8,0x6ae2e1d0,0x6ae2e1dc,0x6ae2e1e8
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403311551471\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403311551471\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
        6⤵
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403311551471\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403311551471\assistant\assistant_installer.exe" --version
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403311551471\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403311551471\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x840040,0x84004c,0x840058
        7⤵
        
        PID:4908
    - - C:\Users\Admin\Pictures\VMcxT8mLFvP1phhRIPuUZ3aq.exe
        
        "C:\Users\Admin\Pictures\VMcxT8mLFvP1phhRIPuUZ3aq.exe"
        5⤵
        
        PID:5496
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:4808
- C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
  2⤵
  PID:4320
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 900
    3⤵
    - Program crash
    PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  PID:5544
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    PID:5616
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:5808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\271347359027_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4320 -ip 4320
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1604 -ip 1604
1⤵
PID:584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5232

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
PID:5320

C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
1⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3100 -ip 3100
1⤵
PID:4972

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
PID:3276

C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion