amadey | 22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d

Analysis

max time kernel
98s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
05/04/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
Size

1.8MB
MD5

d22ac552bde50aec908a505ab37377b6
SHA1

c5f7d3f19293ffa045aec238704e0417bafd5261
SHA256

22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d
SHA512

1d8467c41fbe7126b4a8b8472219b173dcecde20427fed7c34df1ad9f9fb064b67fe913b0f3c06ab2e2363720d3e8a53d3cedf7df7424ad4be6ae317d1bb8cca
SSDEEP

49152:HPMWECeSMTZQli5qxC01Z/qX/AubYCm/Faszje:HtECe7ZPqY0youbFm/Ms

Score

10^/10

amadey glupteba redline risepro zgrat @oleh_psp jok123 livetraffic discovery dropper evasion infostealer loader persistence rat spyware stealer themida trojan

Malware Config

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

Jok123

185.215.113.67:26260

Extracted

Family

redline

Botnet

@OLEH_PSP

185.172.128.33:8970

Extracted

Family

redline

Botnet

LiveTraffic

4.185.137.132:1632

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 6 IoCs

resource	yara_rule
behavioral2/files/0x0002000000025c8d-31.dat	family_zgrat_v1
behavioral2/memory/2900-46-0x00000000003C0000-0x000000000057C000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0002000000025cab-140.dat	family_zgrat_v1
behavioral2/memory/1052-156-0x0000000000EB0000-0x0000000000F32000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0002000000025caf-162.dat	family_zgrat_v1
behavioral2/memory/3084-177-0x0000000000760000-0x00000000007DA000-memory.dmp	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 8 IoCs

resource	yara_rule
behavioral2/memory/1228-1003-0x0000000000400000-0x0000000002F3F000-memory.dmp	family_glupteba
behavioral2/memory/2268-1008-0x0000000000400000-0x0000000002F3F000-memory.dmp	family_glupteba
behavioral2/memory/1228-1093-0x0000000000400000-0x0000000002F3F000-memory.dmp	family_glupteba
behavioral2/memory/2268-1095-0x0000000000400000-0x0000000002F3F000-memory.dmp	family_glupteba
behavioral2/memory/4044-1156-0x0000000000400000-0x0000000002F3F000-memory.dmp	family_glupteba
behavioral2/memory/2116-1168-0x0000000000400000-0x0000000002F3F000-memory.dmp	family_glupteba
behavioral2/memory/2116-1282-0x0000000000400000-0x0000000002F3F000-memory.dmp	family_glupteba
behavioral2/memory/4044-1284-0x0000000000400000-0x0000000002F3F000-memory.dmp	family_glupteba

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 9 IoCs

resource	yara_rule
behavioral2/files/0x0002000000025c90-64.dat	family_redline
behavioral2/memory/752-81-0x00000000000D0000-0x0000000000120000-memory.dmp	family_redline
behavioral2/files/0x0002000000025c99-89.dat	family_redline
behavioral2/files/0x0002000000025c9b-94.dat	family_redline
behavioral2/memory/4592-106-0x00000000000D0000-0x0000000000122000-memory.dmp	family_redline
behavioral2/memory/4680-131-0x0000000000650000-0x00000000006DC000-memory.dmp	family_redline
behavioral2/files/0x0002000000025cab-140.dat	family_redline
behavioral2/memory/1052-156-0x0000000000EB0000-0x0000000000F32000-memory.dmp	family_redline
behavioral2/memory/4320-182-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe = "0"	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
13	3364	rundll32.exe
60	612	rundll32.exe
60	612	rundll32.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2492	netsh.exe
5008	netsh.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe

Executes dropped EXE 29 IoCs

pid	Process
1060	explorgu.exe
2900	alex1234.exe
752	redlinepanel.exe
4592	propro.exe
4680	Traffic.exe
1052	32456.exe
3084	goldprimeldlldf.exe
2728	NewB.exe
4304	swiiiii.exe
3148	koooooo.exe
976	go.exe
5800	random.exe
5840	file300un.exe
6004	U4hrdAzunMZlJlxNJ4fomsUB.exe
1228	tn75j8fVFVwpVQQFaac8cj0U.exe
2268	8bpWtrAElyV7jWYUty48Q0KU.exe
2332	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe
5152	mpe9gbf1k9KPT0oRKFg1wnN3.exe
4296	mpe9gbf1k9KPT0oRKFg1wnN3.exe
5956	mpe9gbf1k9KPT0oRKFg1wnN3.exe
4152	mpe9gbf1k9KPT0oRKFg1wnN3.exe
6032	mpe9gbf1k9KPT0oRKFg1wnN3.exe
4044	8bpWtrAElyV7jWYUty48Q0KU.exe
2116	tn75j8fVFVwpVQQFaac8cj0U.exe
3396	Assistant_108.0.5067.20_Setup.exe_sfx.exe
2736	assistant_installer.exe
5308	assistant_installer.exe
5852	NewB.exe
5584	csrss.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Wine	22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
Key opened	\REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Wine	explorgu.exe

Loads dropped DLL 12 IoCs

pid	Process
1876	rundll32.exe
3364	rundll32.exe
612	rundll32.exe
5152	mpe9gbf1k9KPT0oRKFg1wnN3.exe
4296	mpe9gbf1k9KPT0oRKFg1wnN3.exe
5956	mpe9gbf1k9KPT0oRKFg1wnN3.exe
4152	mpe9gbf1k9KPT0oRKFg1wnN3.exe
6032	mpe9gbf1k9KPT0oRKFg1wnN3.exe
2736	assistant_installer.exe
2736	assistant_installer.exe
5308	assistant_installer.exe
5308	assistant_installer.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 17 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0004000000025ccc-534.dat	themida
behavioral2/memory/5800-587-0x0000000000730000-0x0000000000ED2000-memory.dmp	themida
behavioral2/memory/5800-594-0x0000000000730000-0x0000000000ED2000-memory.dmp	themida
behavioral2/memory/5800-599-0x0000000000730000-0x0000000000ED2000-memory.dmp	themida
behavioral2/memory/5800-608-0x0000000000730000-0x0000000000ED2000-memory.dmp	themida
behavioral2/memory/5800-638-0x0000000000730000-0x0000000000ED2000-memory.dmp	themida
behavioral2/memory/5800-603-0x0000000000730000-0x0000000000ED2000-memory.dmp	themida
behavioral2/memory/5800-642-0x0000000000730000-0x0000000000ED2000-memory.dmp	themida
behavioral2/files/0x000100000002a837-887.dat	themida
behavioral2/memory/2332-896-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp	themida
behavioral2/memory/2332-901-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp	themida
behavioral2/memory/2332-910-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp	themida
behavioral2/memory/2332-912-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp	themida
behavioral2/memory/2332-914-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp	themida
behavioral2/memory/2332-918-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp	themida
behavioral2/memory/2332-920-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp	themida
behavioral2/memory/2332-1098-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp	themida

Windows security modification 2 TTPs 8 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe = "0"	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file300un.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001082001\\go.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Microsoft\Windows\CurrentVersion\Run\random.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001084001\\random.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tn75j8fVFVwpVQQFaac8cj0U.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	random.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	mpe9gbf1k9KPT0oRKFg1wnN3.exe
File opened (read-only)	\??\F:	mpe9gbf1k9KPT0oRKFg1wnN3.exe
File opened (read-only)	\??\D:	mpe9gbf1k9KPT0oRKFg1wnN3.exe
File opened (read-only)	\??\F:	mpe9gbf1k9KPT0oRKFg1wnN3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
61	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	api.myip.com
75	ipinfo.io
82	api.myip.com
85	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000025cd1-345.dat	autoit_exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3316	22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
1060	explorgu.exe
2332	XzWS1Jq5Ke8wGi8VY3xJYYgE.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 1116	2900	alex1234.exe	80
PID 3084 set thread context of 4320	3084	goldprimeldlldf.exe	90
PID 4304 set thread context of 416	4304	swiiiii.exe	100
PID 3148 set thread context of 936	3148	koooooo.exe	107
PID 5840 set thread context of 5708	5840	file300un.exe	142

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tn75j8fVFVwpVQQFaac8cj0U.exe
File opened (read-only)	\??\VBoxMiniRdrDN	8bpWtrAElyV7jWYUty48Q0KU.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
File opened for modification	C:\Windows\rss	8bpWtrAElyV7jWYUty48Q0KU.exe
File created	C:\Windows\rss\csrss.exe	8bpWtrAElyV7jWYUty48Q0KU.exe
File opened for modification	C:\Windows\rss	tn75j8fVFVwpVQQFaac8cj0U.exe
File created	C:\Windows\rss\csrss.exe	tn75j8fVFVwpVQQFaac8cj0U.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3576	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1592	4304	WerFault.exe	95
3344	3148	WerFault.exe	105

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5008	schtasks.exe
5000	schtasks.exe
1112	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	8bpWtrAElyV7jWYUty48Q0KU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	mpe9gbf1k9KPT0oRKFg1wnN3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	mpe9gbf1k9KPT0oRKFg1wnN3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	mpe9gbf1k9KPT0oRKFg1wnN3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	propro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	propro.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3316	22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
3316	22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
1060	explorgu.exe
1060	explorgu.exe
3364	rundll32.exe
3364	rundll32.exe
3364	rundll32.exe
3364	rundll32.exe
3364	rundll32.exe
3364	rundll32.exe
4680	Traffic.exe
3364	rundll32.exe
3364	rundll32.exe
3364	rundll32.exe
3364	rundll32.exe
416	RegAsm.exe
416	RegAsm.exe
416	RegAsm.exe
416	RegAsm.exe
4320	RegAsm.exe
4320	RegAsm.exe
4320	RegAsm.exe
4320	RegAsm.exe
3200	powershell.exe
4592	propro.exe
936	RegAsm.exe
936	RegAsm.exe
936	RegAsm.exe
936	RegAsm.exe
3200	powershell.exe
3200	powershell.exe
5016	msedge.exe
5016	msedge.exe
3404	msedge.exe
3404	msedge.exe
1152	msedge.exe
1152	msedge.exe
6140	msedge.exe
6140	msedge.exe
5840	file300un.exe
5840	file300un.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
4592	propro.exe
1052	32456.exe
1052	32456.exe
4320	RegAsm.exe
4320	RegAsm.exe
5688	powershell.exe
5688	powershell.exe
5688	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	Traffic.exe
Token: SeDebugPrivilege	1052	32456.exe
Token: SeBackupPrivilege	4680	Traffic.exe
Token: SeSecurityPrivilege	4680	Traffic.exe
Token: SeSecurityPrivilege	4680	Traffic.exe
Token: SeSecurityPrivilege	4680	Traffic.exe
Token: SeSecurityPrivilege	4680	Traffic.exe
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	4592	propro.exe
Token: SeBackupPrivilege	1052	32456.exe
Token: SeSecurityPrivilege	1052	32456.exe
Token: SeSecurityPrivilege	1052	32456.exe
Token: SeSecurityPrivilege	1052	32456.exe
Token: SeSecurityPrivilege	1052	32456.exe
Token: SeDebugPrivilege	5840	file300un.exe
Token: SeDebugPrivilege	4320	RegAsm.exe
Token: SeDebugPrivilege	5708	msbuild.exe
Token: SeDebugPrivilege	5688	powershell.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeDebugPrivilege	5212	powershell.exe
Token: SeDebugPrivilege	2268	8bpWtrAElyV7jWYUty48Q0KU.exe
Token: SeImpersonatePrivilege	2268	8bpWtrAElyV7jWYUty48Q0KU.exe
Token: SeDebugPrivilege	1228	tn75j8fVFVwpVQQFaac8cj0U.exe
Token: SeImpersonatePrivilege	1228	tn75j8fVFVwpVQQFaac8cj0U.exe
Token: SeDebugPrivilege	1116	RegAsm.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	5616	powershell.exe
Token: SeDebugPrivilege	3640	powershell.exe
Token: SeDebugPrivilege	6024	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
976	go.exe
976	go.exe
976	go.exe
976	go.exe
976	go.exe
976	go.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
976	go.exe
976	go.exe
976	go.exe
976	go.exe
976	go.exe
976	go.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2900	1060	explorgu.exe	77
PID 1060 wrote to memory of 2900	1060	explorgu.exe	77
PID 1060 wrote to memory of 2900	1060	explorgu.exe	77
PID 2900 wrote to memory of 5088	2900	alex1234.exe	79
PID 2900 wrote to memory of 5088	2900	alex1234.exe	79
PID 2900 wrote to memory of 5088	2900	alex1234.exe	79
PID 2900 wrote to memory of 1116	2900	alex1234.exe	80
PID 2900 wrote to memory of 1116	2900	alex1234.exe	80
PID 2900 wrote to memory of 1116	2900	alex1234.exe	80
PID 2900 wrote to memory of 1116	2900	alex1234.exe	80
PID 2900 wrote to memory of 1116	2900	alex1234.exe	80
PID 2900 wrote to memory of 1116	2900	alex1234.exe	80
PID 2900 wrote to memory of 1116	2900	alex1234.exe	80
PID 2900 wrote to memory of 1116	2900	alex1234.exe	80
PID 1060 wrote to memory of 752	1060	explorgu.exe	81
PID 1060 wrote to memory of 752	1060	explorgu.exe	81
PID 1060 wrote to memory of 752	1060	explorgu.exe	81
PID 1116 wrote to memory of 4592	1116	RegAsm.exe	82
PID 1116 wrote to memory of 4592	1116	RegAsm.exe	82
PID 1116 wrote to memory of 4592	1116	RegAsm.exe	82
PID 1116 wrote to memory of 4680	1116	RegAsm.exe	83
PID 1116 wrote to memory of 4680	1116	RegAsm.exe	83
PID 1060 wrote to memory of 1052	1060	explorgu.exe	86
PID 1060 wrote to memory of 1052	1060	explorgu.exe	86
PID 1060 wrote to memory of 3084	1060	explorgu.exe	88
PID 1060 wrote to memory of 3084	1060	explorgu.exe	88
PID 1060 wrote to memory of 3084	1060	explorgu.exe	88
PID 3084 wrote to memory of 4320	3084	goldprimeldlldf.exe	90
PID 3084 wrote to memory of 4320	3084	goldprimeldlldf.exe	90
PID 3084 wrote to memory of 4320	3084	goldprimeldlldf.exe	90
PID 3084 wrote to memory of 4320	3084	goldprimeldlldf.exe	90
PID 3084 wrote to memory of 4320	3084	goldprimeldlldf.exe	90
PID 3084 wrote to memory of 4320	3084	goldprimeldlldf.exe	90
PID 3084 wrote to memory of 4320	3084	goldprimeldlldf.exe	90
PID 3084 wrote to memory of 4320	3084	goldprimeldlldf.exe	90
PID 1060 wrote to memory of 2728	1060	explorgu.exe	91
PID 1060 wrote to memory of 2728	1060	explorgu.exe	91
PID 1060 wrote to memory of 2728	1060	explorgu.exe	91
PID 2728 wrote to memory of 1112	2728	NewB.exe	92
PID 2728 wrote to memory of 1112	2728	NewB.exe	92
PID 2728 wrote to memory of 1112	2728	NewB.exe	92
PID 1060 wrote to memory of 4304	1060	explorgu.exe	95
PID 1060 wrote to memory of 4304	1060	explorgu.exe	95
PID 1060 wrote to memory of 4304	1060	explorgu.exe	95
PID 1060 wrote to memory of 1876	1060	explorgu.exe	97
PID 1060 wrote to memory of 1876	1060	explorgu.exe	97
PID 1060 wrote to memory of 1876	1060	explorgu.exe	97
PID 1876 wrote to memory of 3364	1876	rundll32.exe	98
PID 1876 wrote to memory of 3364	1876	rundll32.exe	98
PID 3364 wrote to memory of 3428	3364	rundll32.exe	99
PID 3364 wrote to memory of 3428	3364	rundll32.exe	99
PID 4304 wrote to memory of 416	4304	swiiiii.exe	100
PID 4304 wrote to memory of 416	4304	swiiiii.exe	100
PID 4304 wrote to memory of 416	4304	swiiiii.exe	100
PID 4304 wrote to memory of 416	4304	swiiiii.exe	100
PID 4304 wrote to memory of 416	4304	swiiiii.exe	100
PID 4304 wrote to memory of 416	4304	swiiiii.exe	100
PID 4304 wrote to memory of 416	4304	swiiiii.exe	100
PID 4304 wrote to memory of 416	4304	swiiiii.exe	100
PID 4304 wrote to memory of 416	4304	swiiiii.exe	100
PID 1060 wrote to memory of 3148	1060	explorgu.exe	122
PID 1060 wrote to memory of 3148	1060	explorgu.exe	122
PID 1060 wrote to memory of 3148	1060	explorgu.exe	122
PID 3148 wrote to memory of 936	3148	koooooo.exe	107

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
"C:\Users\Admin\AppData\Local\Temp\22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3316

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
  "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4592
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4680
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:2588
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:5524
- C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
  "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
  "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
  "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1112
- C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 880
    3⤵
    - Program crash
    PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:3428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\280069375290_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3200
- C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
  "C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 876
    3⤵
    - Program crash
    PID:3344
- C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe
  "C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa0263cb8,0x7fffa0263cc8,0x7fffa0263cd8
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,11419676588978741832,7086194699634376494,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,11419676588978741832,7086194699634376494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,11419676588978741832,7086194699634376494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11419676588978741832,7086194699634376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11419676588978741832,7086194699634376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11419676588978741832,7086194699634376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11419676588978741832,7086194699634376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11419676588978741832,7086194699634376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11419676588978741832,7086194699634376494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,11419676588978741832,7086194699634376494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
    3⤵
    PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa0263cb8,0x7fffa0263cc8,0x7fffa0263cd8
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,14095331568471137760,8609226562189663442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa0263cb8,0x7fffa0263cc8,0x7fffa0263cd8
      4⤵
      PID:3148
- C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
  "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
  2⤵
  PID:3188
- C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe
  "C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  PID:5800
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:612
- C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe
  "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:5840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5708
  - - C:\Users\Admin\Pictures\U4hrdAzunMZlJlxNJ4fomsUB.exe
      "C:\Users\Admin\Pictures\U4hrdAzunMZlJlxNJ4fomsUB.exe"
      4⤵
      Executes dropped EXE
      PID:6004
  - - C:\Users\Admin\Pictures\tn75j8fVFVwpVQQFaac8cj0U.exe
      "C:\Users\Admin\Pictures\tn75j8fVFVwpVQQFaac8cj0U.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1228
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5212
    - - C:\Users\Admin\Pictures\tn75j8fVFVwpVQQFaac8cj0U.exe
        
        "C:\Users\Admin\Pictures\tn75j8fVFVwpVQQFaac8cj0U.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks for VirtualBox DLLs, possible anti-VM trick
        Drops file in Windows directory
        
        PID:2116
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:5616
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        
        PID:948
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:5008
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:6024
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2588
  - - C:\Users\Admin\Pictures\8bpWtrAElyV7jWYUty48Q0KU.exe
      "C:\Users\Admin\Pictures\8bpWtrAElyV7jWYUty48Q0KU.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2268
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5692
    - - C:\Users\Admin\Pictures\8bpWtrAElyV7jWYUty48Q0KU.exe
        
        "C:\Users\Admin\Pictures\8bpWtrAElyV7jWYUty48Q0KU.exe"
        5⤵
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks for VirtualBox DLLs, possible anti-VM trick
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        
        PID:4044
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        
        PID:4548
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:2492
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:3640
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:772
      - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        6⤵
        Executes dropped EXE
        
        PID:5584
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        7⤵
        Creates scheduled task(s)
        
        PID:5008
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        7⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        7⤵
        
        PID:5344
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        7⤵
        Creates scheduled task(s)
        
        PID:5000
        
        C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        7⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        9⤵
        Launches sc.exe
        
        PID:3576
  - - C:\Users\Admin\Pictures\XzWS1Jq5Ke8wGi8VY3xJYYgE.exe
      "C:\Users\Admin\Pictures\XzWS1Jq5Ke8wGi8VY3xJYYgE.exe"
      4⤵
      Modifies firewall policy service
      Windows security bypass
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2332
  - - C:\Users\Admin\Pictures\mpe9gbf1k9KPT0oRKFg1wnN3.exe
      "C:\Users\Admin\Pictures\mpe9gbf1k9KPT0oRKFg1wnN3.exe" --silent --allusers=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Modifies system certificate store
      PID:5152
    - - C:\Users\Admin\Pictures\mpe9gbf1k9KPT0oRKFg1wnN3.exe
        
        C:\Users\Admin\Pictures\mpe9gbf1k9KPT0oRKFg1wnN3.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6c0fe1d0,0x6c0fe1dc,0x6c0fe1e8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\mpe9gbf1k9KPT0oRKFg1wnN3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\mpe9gbf1k9KPT0oRKFg1wnN3.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5956
    - - C:\Users\Admin\Pictures\mpe9gbf1k9KPT0oRKFg1wnN3.exe
        
        "C:\Users\Admin\Pictures\mpe9gbf1k9KPT0oRKFg1wnN3.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5152 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240405003737" --session-guid=447772fc-abc0-4542-9f3c-2da0c1641a57 --server-tracking-blob=YjUxMTcxNzhmMTczNjIwZjUzMmRjMDI3ZmNiY2E3YWMxNzc0YjRiMzgxZDQwYTRkZjc2MTdhZjViYzAwMjg0Njp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIyNzc0NTAuMzQ0NCIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjNhNGFjZWM0LWJjZjAtNGM0Mi1iNGVjLWIwODZjMzRhYzBmYiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=8805000000000000
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        
        PID:4152
      - C:\Users\Admin\Pictures\mpe9gbf1k9KPT0oRKFg1wnN3.exe
        
        C:\Users\Admin\Pictures\mpe9gbf1k9KPT0oRKFg1wnN3.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6b5ae1d0,0x6b5ae1dc,0x6b5ae1e8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050037371\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050037371\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
        5⤵
        Executes dropped EXE
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050037371\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050037371\assistant\assistant_installer.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050037371\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050037371\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0xee0040,0xee004c,0xee0058
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5308
  - - C:\Users\Admin\Pictures\mpF0mSSySfmWIZ7MA0YlH1RC.exe
      "C:\Users\Admin\Pictures\mpF0mSSySfmWIZ7MA0YlH1RC.exe"
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
        5⤵
        
        PID:1636
      - C:\Windows\SYSTEM32\msiexec.exe
        
        "msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe
        
        "ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"
        6⤵
        
        PID:860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
    3⤵
    PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4304 -ip 4304
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3148 -ip 3148
1⤵
PID:3384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5264

C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
1⤵
- Executes dropped EXE
PID:5852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2476
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F6E3510C4C0E955068C665F27F80727C
  2⤵
  PID:5608
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9CB540DF904E502AF8C356CD59ADAC75 E Global\MSI0000
  2⤵
  PID:5204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4CA5AB278CD70F2D9C997AF2B4940EBC M Global\MSI0000
  2⤵
  PID:3464

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:4256

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ef855 /state1:0x41c64e6d
1⤵
PID:5956

C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58dbb8.rbs

Filesize
898KB

MD5
622ef25b4688c98eb84e3812e9feef19

SHA1
94d80d113806badfd3558f94074a07f0802f1f01

SHA256
37eb141d57fe721782c45aeac2bb4ba136ab77c2ea2602464d369a612994c5d6

SHA512
7a03d2926825f25ca8c4b59bdc88156f00cda232b15217b30c79504845274475c59aa36d23c5934d39240fc508a7f7fb418690e6591d67b24e330a4de5df54aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ae626d9a72417b14570daa8fcd5d34a4

SHA1
c103ebaf4d760df722d620df87e6f07c0486439f

SHA256
52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a

SHA512
a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ded21ddc295846e2b00e1fd766c807db

SHA1
497eb7c9c09cb2a247b4a3663ce808869872b410

SHA256
26025f86effef56caa2ee50a64e219c762944b1e50e465be3a6b454bc0ed7305

SHA512
ddfaa73032590de904bba398331fdbf188741d96a17116ada50298b42d6eb7b20d6e50b0cfae8b17e2f145997b8ebce6c8196e6f46fbe11f133d3d82ce3656db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0407c5de270b9ae0ceee6cb9b61bbf1

SHA1
fb2bb8184c1b8e680bf873e5537e1260f057751e

SHA256
a56989933628f6a677ad09f634fc9b7dd9cf7d06c72a76ddbb8221bc4a62ffcd

SHA512
65162bf07705dfdd348d4eaf0a3feba08dc2c0942a3a052b4492d0675ab803b104c03c945f5608fac9544681e0fe8b81d1aaca859663e79aa87fcb591ddb8136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4731c4fe1721d20956fe41de4572d35c

SHA1
e6ddc6b5f9cfd8d04178becc806032b1d856a326

SHA256
0df04323222e2c3c8b4d6a646a05034f028f03a13406a47d580c20e2f18cb984

SHA512
905c55ffaa8991af11bf29c13d786d4a684046c04935a91f701f85e0ba0ebb259c490205331b4762629ad7d7e7f1ebc8dddef9809cb680af7da9402c3efb69e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
39bea96d0785239c12d30cf7ef9b8fda

SHA1
70a63caba97f5f222199985089293f1f682f01c5

SHA256
df9cc546cb1e7f6813b6c1094e2e9b8708de08c3c281c20b7b465de53f073401

SHA512
fcc1fa20afdb9c4ad22a0a84236b025e083bed4d48201f7b7d1387107de728398d6a59a7c16d67852752d69eb770337103c8e74e1c93af4bc457119fdd80f3d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7797ee6f5024d8fdf7774b339324ab12

SHA1
dd9241d24bcc3cd7774ff97ba1cee2e61268fa8a

SHA256
fb09ddacdfe0565c8b2088e80f66e36003eb9a4ec0d1085d781fc8bcbb518fab

SHA512
e99097a1b41f76887b91b92e08f16388d5bf50a2dea6349b7f897e649ccda97f5049682569eeb36634208d20b19d79474d7d896eb21ecd9096a14259f9a794e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050037371\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe

Filesize
2.5MB

MD5
20d293b9bf23403179ca48086ba88867

SHA1
dedf311108f607a387d486d812514a2defbd1b9e

SHA256
fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348

SHA512
5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050037371\opera_package

Filesize
103.9MB

MD5
f9172d1f7a8316c593bdddc47f403b06

SHA1
ed1e5a40b040af2c60ed6c2536b3bf7ee55e0e52

SHA256
473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b

SHA512
f51ab2bdf29ca6839e4f7cf1fac1bdfc03ba2da4569a8f21e5d2ee13e6519097c3da40bf0b4ca7642286ed033d0126bbd14ef7842eb9f2db1d6e503849521b02

Download Submit
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

Filesize
1.8MB

MD5
d22ac552bde50aec908a505ab37377b6

SHA1
c5f7d3f19293ffa045aec238704e0417bafd5261

SHA256
22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d

SHA512
1d8467c41fbe7126b4a8b8472219b173dcecde20427fed7c34df1ad9f9fb064b67fe913b0f3c06ab2e2363720d3e8a53d3cedf7df7424ad4be6ae317d1bb8cca

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe

Filesize
1.7MB

MD5
85a15f080b09acace350ab30460c8996

SHA1
3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

SHA256
3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

SHA512
ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe

Filesize
301KB

MD5
832eb4dc3ed8ceb9a1735bd0c7acaf1b

SHA1
b622a406927fbb8f6cd5081bd4455fb831948fca

SHA256
2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7

SHA512
3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe

Filesize
499KB

MD5
83d0b41c7a3a0d29a268b49a313c5de5

SHA1
46f3251c771b67b40b1f3268caef8046174909a5

SHA256
09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9

SHA512
705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe

Filesize
464KB

MD5
c084d6f6ba40534fbfc5a64b21ef99ab

SHA1
0b4a17da83c0a8abbc8fab321931d5447b32b720

SHA256
afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624

SHA512
a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe

Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe

Filesize
321KB

MD5
1c7d0f34bb1d85b5d2c01367cc8f62ef

SHA1
33aedadb5361f1646cffd68791d72ba5f1424114

SHA256
e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

SHA512
53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe

Filesize
379KB

MD5
90f41880d631e243cec086557cb74d63

SHA1
cb385e4172cc227ba72baf29ca1c4411fa99a26d

SHA256
23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0

SHA512
eeb85b34aa66a7e9a1b1807012999ee439433df23126a52ffa8d4b3cb2026be3bcf63ca25f143de58ba929c0d4feeaf2a603fd6ec6b5379fc48147c22f3783e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe

Filesize
894KB

MD5
2f8912af892c160c1c24c9f38a60c1ab

SHA1
d2deae508e262444a8f15c29ebcc7ebbe08a3fdb

SHA256
59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308

SHA512
0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe

Filesize
3.0MB

MD5
c75832c14209324e2a4b86c9f43b9a16

SHA1
daae309d8205fb9867ceb2eaa02666d01dd76c71

SHA256
32aff3e6c5fd16ea096efc696578e322d4baf14ed7c900946725b407d8efdbd0

SHA512
71152ebd9e2d59545b53595544bf99d1dde004e358c21bbe840982ff3e2a16bcc0e6e8b57e3a944f30325b7f829f5c86fe413d40a04b7ee9162d799a7723077b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe

Filesize
400KB

MD5
f64a5b8a765d95f6a3c05ed366cbe802

SHA1
3fe9c9482f3e68f067d0c3c4ae9661a7f9f70f50

SHA256
0a9df33580d2f032589301602ae78df0fd0daa276eb5308695e5978626996ff7

SHA512
2e259ba2c57acf6f4e99f717a25577066e1e7b1af5d5b88d3b3a7f1e4b0dec88391af001c3ab29335767ac0e49cea2748ce2b1633647399e4031deffd7f843e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404050037369735152.dll

Filesize
4.6MB

MD5
2a3159d6fef1100348d64bf9c72d15ee

SHA1
52a08f06f6baaa12163b92f3c6509e6f1e003130

SHA256
668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303

SHA512
251c0d3cdd0597b962d4e32cf588a82454c42067cbe5e35b41b0548eea742ea25815e5d6830b63c1992b5730a4e6d7c005fb0019aa4c389549b06fff9a74b38c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp636D.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0qaebwqg.i2a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7FA2.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp807F.tmp

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB71F.tmp

Filesize
20KB

MD5
22be08f683bcc01d7a9799bbd2c10041

SHA1
2efb6041cf3d6e67970135e592569c76fc4c41de

SHA256
451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

SHA512
0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB7B1.tmp

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
109KB

MD5
2afdbe3b99a4736083066a13e4b5d11a

SHA1
4d4856cf02b3123ac16e63d4a448cdbcb1633546

SHA256
8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

SHA512
d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
1.2MB

MD5
92fbdfccf6a63acef2743631d16652a7

SHA1
971968b1378dd89d59d7f84bf92f16fc68664506

SHA256
b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

SHA512
b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe

Filesize
541KB

MD5
1fc4b9014855e9238a361046cfbf6d66

SHA1
c17f18c8246026c9979ab595392a14fe65cc5e9f

SHA256
f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

SHA512
2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe

Filesize
304KB

MD5
cc90e3326d7b20a33f8037b9aab238e4

SHA1
236d173a6ac462d85de4e866439634db3b9eeba3

SHA256
bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

SHA512
b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
c2c50b18afb7f2f77d195f6ebe734d22

SHA1
582f1720e4bee4e672dbd6a3e883bc5239c9009a

SHA256
46d9e9f9e1acbbbeffc154915c071f96b86e8492cd2f8e1f844ec4421438221f

SHA512
1981b81495511c995019268df020a0b47eecfc2ddc2c511d73e67390387d7d8113cd8ae745d3d66dc7cb3b3bc8636f297ce9472d87eb46163cfac7af5a5a13ca

Download Submit
C:\Users\Admin\Pictures\GQBsOo9c0LzguXLn5njyQ1Uw.exe

Filesize
3KB

MD5
442bc720ba4683974b3d5e5d13c05b87

SHA1
8e7270af1557248309de85f1de5bfe85dfe2ae4e

SHA256
74fa86b77107f337dddab4eec51b276b483dec4107e35305067c5077d01581d9

SHA512
3ffca4f1ae507234c2133753e64ea763ff0f34383a8ae1fe994dcdaa5f585f4d89dc0ec97c304ca4a304740c6c7cd93d2862d2d0582dd39dd91214e3787b2179

Download Submit
C:\Users\Admin\Pictures\I0Q8ogz2zszMAqZbDLHBv0ly.exe

Filesize
7KB

MD5
5b423612b36cde7f2745455c5dd82577

SHA1
0187c7c80743b44e9e0c193e993294e3b969cc3d

SHA256
e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

SHA512
c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

Download Submit
C:\Users\Admin\Pictures\QoSdvlxvchDEc0a4dN7ZRPpe.exe

Filesize
3KB

MD5
5ccc3ae4cff33642066351a98bdc8bb2

SHA1
ebe76b88ceb0bba7e91018f7642fd559585f2ced

SHA256
56b6c11ce257f344b31cd031db37e95367effd2e1b772dbcd4838f6d009f1e0d

SHA512
be66699f341d2bd480eb45e242bd99fc195c06792ef38baf0c6d02b24476da07c156d777716699ed8fdf80cd09a9e9344724c474db53304269e2725547b85f6b

Download Submit
C:\Users\Admin\Pictures\U4hrdAzunMZlJlxNJ4fomsUB.exe

Filesize
344KB

MD5
c8cd5c786dec8862ffcc4f25e183d605

SHA1
dc3d8ae58e706dc7350ea83917bd31a3418b4468

SHA256
df273a2fe7be9ed3aa9059b37196a64e2489371d665aa46b8dc25dcb7d755c31

SHA512
67b614c2c6e0407048e7e990ee2485249d24a19a0b039aff377bb54cc6751e454857f7caacf6baf4b47dccc3ce050ca8d1f26c00473e87248b0325aac12193bd

Download Submit
C:\Users\Admin\Pictures\XzWS1Jq5Ke8wGi8VY3xJYYgE.exe

Filesize
4.3MB

MD5
858bb0a3b4fa6a54586402e3ee117076

SHA1
997c31f043347883ea5ed2323a558b6cc5ea9c8e

SHA256
d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35

SHA512
e8374b115f056b5d345c9b5f9c42b3d49e0640d7fad869448f686add6e52b783ecc7fd35ee15a67b944843491a91becf5b7c0bd5603eda01042dd2904c1ad8fd

Download Submit
C:\Users\Admin\Pictures\mpF0mSSySfmWIZ7MA0YlH1RC.exe

Filesize
108.6MB

MD5
8d82aab981db33a652f25f1951eb1bf8

SHA1
88f484430f353879f4ababe64ed8919551ac5b47

SHA256
0f03bbc5a23c73c203f9dcedee184f8ba5842d33e7ec305f3eb244c1ed41765a

SHA512
fce582dee14cbafddf3987e5bf47b7e2c7fa235b71f05aa109f200c1b70d3ee55c2e18523ecfaaa1a243b9b8680a28c60037793bd302203417e2add7c00a6e26

Download Submit
C:\Users\Admin\Pictures\mpe9gbf1k9KPT0oRKFg1wnN3.exe

Filesize
5.1MB

MD5
cd62a4902f85dc15740c20e406dcaca6

SHA1
223bedc2c7496b8012fa0840e79b160d48401837

SHA256
7591dcf3950f9fd00448ce6c96c03a44ebb2136d9720d79dc8e050358c3e5fe1

SHA512
920e2140125e18d802e160af96900efdd5174b848e0e83ca4a73fbb442d442db23c018e46e161f5b1e97abbd0788faeac8f1955c9c47adcc73eab7f803b95bb2

Download Submit
C:\Users\Admin\Pictures\tn75j8fVFVwpVQQFaac8cj0U.exe

Filesize
4.1MB

MD5
41cd2170be3c5e2ae1dfc296a97ea397

SHA1
aaab82b8dda1f62482856bf42f6f1e503fa83468

SHA256
331b56a1da2e5b7a46d41a7a8e7cc50519ba594b03784fa4067ba11c52a86920

SHA512
09975ddec87c7e3f37b85be0a8496c822a9fdd0e9f7a226363df24327c75bb5a0b2920b9ef535db2f7c8b6e01fb514918d3989ff639bc4081ee6f578ef677457

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
5c67728b22a2babeb6eb2d944f7d26eb

SHA1
2172e6f6ee18b965effc58f265c80315e6933893

SHA256
5ef34add9207cae07c9528b5d760921055a372581a4b2f57bd64172dc1746e70

SHA512
a74578742706a8a46abb05f40e032af1852fd2de7161dce4f9e8d34f29347a819fecadfc64df3e0ccf4ca8bfb866baf92c7deb36372cbc4122cf17573b5df1bf

Download Submit
C:\Windows\Installer\MSI28C.tmp

Filesize
195KB

MD5
4298cfa3dab9867af517722fe69b1333

SHA1
ab4809f8c9282e599aa64a8ca9900b09b98e0425

SHA256
cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8

SHA512
37b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b

Download Submit
C:\Windows\Installer\e58dbb5.msi

Filesize
101.9MB

MD5
a198248d82bcfe0548af2dd8b5d234c9

SHA1
b48db4ee1171682510b7f9768a119da78937f0bd

SHA256
5e4fd3d3aa4666014213cd384da90d59bcd77bc7ae7fedcb6951e9c4945fc0fb

SHA512
ebff424004dccf67613e3caa5a04d6865f581125cec31539d86d9bc89e89a0571f979c1a877d651bbcb63aa4cc1c6569cc6af64d69dd0a9b0ddde28b0e24d878

Download Submit
C:\Windows\System32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys

Filesize
1013KB

MD5
321ccdb9223b0801846b9ad131ac4d81

SHA1
ac8fb0fc82a8c30b57962fe5d869fda534053404

SHA256
05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b

SHA512
75b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/416-262-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/416-254-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/752-83-0x0000000004A90000-0x0000000004B22000-memory.dmp

Filesize
584KB

Download
memory/752-107-0x0000000005B50000-0x0000000006168000-memory.dmp

Filesize
6.1MB

Download
memory/752-81-0x00000000000D0000-0x0000000000120000-memory.dmp

Filesize
320KB

Download
memory/752-80-0x0000000073710000-0x0000000073EC1000-memory.dmp

Filesize
7.7MB

Download
memory/752-82-0x0000000004F80000-0x0000000005526000-memory.dmp

Filesize
5.6MB

Download
memory/752-191-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/752-190-0x0000000073710000-0x0000000073EC1000-memory.dmp

Filesize
7.7MB

Download
memory/752-99-0x0000000004C30000-0x0000000004C3A000-memory.dmp

Filesize
40KB

Download
memory/752-98-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/752-108-0x0000000004E20000-0x0000000004F2A000-memory.dmp

Filesize
1.0MB

Download
memory/752-128-0x0000000004DD0000-0x0000000004E1C000-memory.dmp

Filesize
304KB

Download
memory/752-109-0x0000000004D30000-0x0000000004D42000-memory.dmp

Filesize
72KB

Download
memory/752-112-0x0000000004D90000-0x0000000004DCC000-memory.dmp

Filesize
240KB

Download
memory/936-318-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/936-312-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1052-157-0x000000001BCD0000-0x000000001BCE0000-memory.dmp

Filesize
64KB

Download
memory/1052-156-0x0000000000EB0000-0x0000000000F32000-memory.dmp

Filesize
520KB

Download
memory/1052-155-0x00007FFFA4A50000-0x00007FFFA5512000-memory.dmp

Filesize
10.8MB

Download
memory/1060-22-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/1060-1175-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-21-0x0000000005770000-0x0000000005771000-memory.dmp

Filesize
4KB

Download
memory/1060-20-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/1060-23-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/1060-1088-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-24-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/1060-25-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/1060-26-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/1060-1105-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-211-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-18-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-19-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-990-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-864-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-1285-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-475-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-79-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1060-110-0x0000000000F40000-0x00000000013F3000-memory.dmp

Filesize
4.7MB

Download
memory/1116-58-0x0000000073710000-0x0000000073EC1000-memory.dmp

Filesize
7.7MB

Download
memory/1116-186-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/1116-183-0x0000000073710000-0x0000000073EC1000-memory.dmp

Filesize
7.7MB

Download
memory/1116-59-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/1116-51-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/1228-1093-0x0000000000400000-0x0000000002F3F000-memory.dmp

Filesize
43.2MB

Download
memory/1228-1003-0x0000000000400000-0x0000000002F3F000-memory.dmp

Filesize
43.2MB

Download
memory/2116-1282-0x0000000000400000-0x0000000002F3F000-memory.dmp

Filesize
43.2MB

Download
memory/2116-1168-0x0000000000400000-0x0000000002F3F000-memory.dmp

Filesize
43.2MB

Download
memory/2268-1095-0x0000000000400000-0x0000000002F3F000-memory.dmp

Filesize
43.2MB

Download
memory/2268-1008-0x0000000000400000-0x0000000002F3F000-memory.dmp

Filesize
43.2MB

Download
memory/2332-920-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp

Filesize
11.0MB

Download
memory/2332-912-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp

Filesize
11.0MB

Download
memory/2332-901-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp

Filesize
11.0MB

Download
memory/2332-910-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp

Filesize
11.0MB

Download
memory/2332-896-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp

Filesize
11.0MB

Download
memory/2332-918-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp

Filesize
11.0MB

Download
memory/2332-914-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp

Filesize
11.0MB

Download
memory/2332-1098-0x00007FF6B4D90000-0x00007FF6B589A000-memory.dmp

Filesize
11.0MB

Download
memory/2900-47-0x0000000073710000-0x0000000073EC1000-memory.dmp

Filesize
7.7MB

Download
memory/2900-46-0x00000000003C0000-0x000000000057C000-memory.dmp

Filesize
1.7MB

Download
memory/2900-178-0x0000000002970000-0x0000000004970000-memory.dmp

Filesize
32.0MB

Download
memory/2900-48-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download
memory/2900-57-0x0000000002970000-0x0000000004970000-memory.dmp

Filesize
32.0MB

Download
memory/2900-56-0x0000000073710000-0x0000000073EC1000-memory.dmp

Filesize
7.7MB

Download
memory/3084-181-0x0000000073710000-0x0000000073EC1000-memory.dmp

Filesize
7.7MB

Download
memory/3084-177-0x0000000000760000-0x00000000007DA000-memory.dmp

Filesize
488KB

Download
memory/3084-185-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/3084-188-0x0000000073710000-0x0000000073EC1000-memory.dmp

Filesize
7.7MB

Download
memory/3316-2-0x0000000000C80000-0x0000000001133000-memory.dmp

Filesize
4.7MB

Download
memory/3316-4-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/3316-6-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/3316-15-0x0000000000C80000-0x0000000001133000-memory.dmp

Filesize
4.7MB

Download
memory/3316-7-0x0000000005830000-0x0000000005831000-memory.dmp

Filesize
4KB

Download
memory/3316-9-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/3316-8-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/3316-1-0x0000000077D56000-0x0000000077D58000-memory.dmp

Filesize
8KB

Download
memory/3316-0-0x0000000000C80000-0x0000000001133000-memory.dmp

Filesize
4.7MB

Download
memory/3316-10-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/3316-3-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/3316-5-0x0000000005880000-0x0000000005881000-memory.dmp

Filesize
4KB

Download
memory/4044-1156-0x0000000000400000-0x0000000002F3F000-memory.dmp

Filesize
43.2MB

Download
memory/4044-1284-0x0000000000400000-0x0000000002F3F000-memory.dmp

Filesize
43.2MB

Download
memory/4320-182-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4320-189-0x0000000073710000-0x0000000073EC1000-memory.dmp

Filesize
7.7MB

Download
memory/4592-130-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

Filesize
120KB

Download
memory/4592-106-0x00000000000D0000-0x0000000000122000-memory.dmp

Filesize
328KB

Download
memory/4592-105-0x0000000073710000-0x0000000073EC1000-memory.dmp

Filesize
7.7MB

Download
memory/4592-115-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/4592-127-0x0000000005660000-0x00000000056D6000-memory.dmp

Filesize
472KB

Download
memory/4680-209-0x000000001B5B0000-0x000000001B5C2000-memory.dmp

Filesize
72KB

Download
memory/4680-210-0x000000001C260000-0x000000001C29C000-memory.dmp

Filesize
240KB

Download
memory/4680-131-0x0000000000650000-0x00000000006DC000-memory.dmp

Filesize
560KB

Download
memory/4680-134-0x00007FFFA4A50000-0x00007FFFA5512000-memory.dmp

Filesize
10.8MB

Download
memory/4680-135-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Filesize
64KB

Download
memory/4680-208-0x000000001DA10000-0x000000001DB1A000-memory.dmp

Filesize
1.0MB

Download
memory/5708-729-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5800-638-0x0000000000730000-0x0000000000ED2000-memory.dmp

Filesize
7.6MB

Download
memory/5800-587-0x0000000000730000-0x0000000000ED2000-memory.dmp

Filesize
7.6MB

Download
memory/5800-594-0x0000000000730000-0x0000000000ED2000-memory.dmp

Filesize
7.6MB

Download
memory/5800-599-0x0000000000730000-0x0000000000ED2000-memory.dmp

Filesize
7.6MB

Download
memory/5800-608-0x0000000000730000-0x0000000000ED2000-memory.dmp

Filesize
7.6MB

Download
memory/5800-603-0x0000000000730000-0x0000000000ED2000-memory.dmp

Filesize
7.6MB

Download
memory/5800-642-0x0000000000730000-0x0000000000ED2000-memory.dmp

Filesize
7.6MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads