amadey | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Resubmissions

09/04/2024, 08:32

240409-kfg77aaf8510

09/04/2024, 08:32

09/04/2024, 08:32

09/04/2024, 08:32

11/03/2024, 08:03

10/03/2024, 15:15

Analysis

max time kernel
1198s
max time network
1199s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FUCKER.exe
Size 10KB
Sample240409-kfglnaaf84
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey asyncrat quasar redline sectoprat xmrig zgrat 666 kz1 office04 evasion infostealer miner persistence rat spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

185.196.10.233:4782

Mutex

a244256d-314d-4857-83fe-790ac24d7897

Attributes

encryption_key
0EC03133971030F6D05E6D59F71626F6543BBE65
install_name
gfdgfdg.exe
log_directory
Logs
reconnect_delay
3000
startup_key
fgfdhdgg
subdirectory
gfgfgf

Extracted

Family

amadey

Version

4.18

http://185.172.128.3

Attributes

install_dir
One_Dragon_Center
install_file
MSI.CentralServer.exe
strings_key
fd2f5851d3165c210396dcbe9930d294
url_paths
/QajE3OBS/index.php

rc4.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

77.232.132.25:5001

Mutex

AsyncMutex_6SI8OJU68

Attributes

delay
3
install
false
install_file
service.exe
install_folder
%AppData%

aes.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

77.232.132.25:4999

Mutex

8892f097-602a-41ca-8df2-0bf3fd113bd2

Attributes

encryption_key
790BD6D1C1540AE1BFB811F2DC1E0185525C5DCB
install_name
LestaClient.exe
log_directory
LestaLogs
reconnect_delay
3000
startup_key
Lesta Game Center
subdirectory
Lesta

Extracted

Family

redline

Botnet

195.20.16.103:18305

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 7 IoCs

resource	yara_rule
behavioral1/files/0x0009000000016d0d-411.dat	family_zgrat_v1
behavioral1/memory/2784-416-0x0000000000F90000-0x000000000142E000-memory.dmp	family_zgrat_v1
behavioral1/files/0x001300000001749c-425.dat	family_zgrat_v1
behavioral1/memory/1640-428-0x0000000000FB0000-0x00000000016C0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2516-955-0x0000000005130000-0x00000000055DB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2516-952-0x0000000005130000-0x00000000055DB000-memory.dmp	family_zgrat_v1
behavioral1/files/0x000600000001a56a-1538.dat	family_zgrat_v1

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0012000000016c6b-202.dat	family_quasar
behavioral1/memory/2592-203-0x00000000013A0000-0x00000000016C4000-memory.dmp	family_quasar
behavioral1/files/0x0005000000018778-637.dat	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2616-729-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2616-740-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2616-748-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2616-753-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2616-751-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2968-717-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2968-718-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2968-721-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2968-723-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2968-725-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000b000000004e76-644.dat	family_asyncrat

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2560-775-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2560-777-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2560-786-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2560-787-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2560-788-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2560-789-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2560-790-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2560-830-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2560-834-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 4 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2472-177-0x00000000046D0000-0x0000000004736000-memory.dmp	net_reactor
behavioral1/memory/2472-181-0x0000000004780000-0x00000000047E4000-memory.dmp	net_reactor
behavioral1/memory/2432-551-0x0000000000ED0000-0x000000000143C000-memory.dmp	net_reactor
behavioral1/files/0x000500000001866b-550.dat	net_reactor

Executes dropped EXE 8 IoCs

pid	Process
2472	dsdasda.exe
1624	FirstZ.exe
2592	hghgfhjfhmain.exe
2892	boomlumma.exe
2784	M5traider.exe
1640	svchost.exe
1884	cp.exe
772	RtkAudUKZ1.exe

Loads dropped DLL 16 IoCs

pid	Process
2196	FUCKER.exe
2196	FUCKER.exe
2196	FUCKER.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
2196	FUCKER.exe
2196	FUCKER.exe
2196	FUCKER.exe
2196	FUCKER.exe
2196	FUCKER.exe
2196	FUCKER.exe
2196	FUCKER.exe
2196	FUCKER.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2560-769-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-771-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-774-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-775-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-777-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-772-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-770-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-786-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-787-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-788-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-789-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-790-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-830-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2560-834-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\RtkAudUApp64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\RtkAudUKZ1.exe"	RtkAudUKZ1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs

Web Service

T1102

flow	ioc
251	pastebin.com
333	bitbucket.org
422	pastebin.com
20	bitbucket.org
21	bitbucket.org
58	pastebin.com
75	raw.githubusercontent.com
245	pastebin.com
332	bitbucket.org
423	pastebin.com
173	raw.githubusercontent.com
174	raw.githubusercontent.com
12	raw.githubusercontent.com
13	raw.githubusercontent.com
59	pastebin.com
134	bitbucket.org
135	bitbucket.org
66	pastebin.com
143	pastebin.com
540	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2892 set thread context of 2120	2892	boomlumma.exe	35

Launches sc.exe 23 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2672	sc.exe
1040	sc.exe
2052	sc.exe
1712	sc.exe
1756	sc.exe
2884	sc.exe
2032	sc.exe
2576	sc.exe
2516	sc.exe
1996	sc.exe
612	sc.exe
2856	sc.exe
2420	sc.exe
1096	sc.exe
1924	sc.exe
2124	sc.exe
3052	sc.exe
2656	sc.exe
1608	sc.exe
2572	sc.exe
592	sc.exe
2364	sc.exe
2220	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1660	2472	WerFault.exe	29
2016	2120	WerFault.exe	35
2632	2156	WerFault.exe	68
1260	1640	WerFault.exe	40
2028	1072	WerFault.exe	185
2000	308	WerFault.exe	166

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1376	schtasks.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	FUCKER.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	FUCKER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	FUCKER.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	FUCKER.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	FUCKER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	FUCKER.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FUCKER.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FUCKER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	FUCKER.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	FUCKER.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1956	PING.EXE
2340	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1900	powershell.exe
1532	powershell.exe
1816	powershell.exe
1872	powershell.exe
2400	powershell.exe
2944	powershell.exe
1856	powershell.exe
884	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	FUCKER.exe
Token: SeDebugPrivilege	2592	hghgfhjfhmain.exe
Token: SeDebugPrivilege	772	RtkAudUKZ1.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2472	2196	FUCKER.exe	29
PID 2196 wrote to memory of 2472	2196	FUCKER.exe	29
PID 2196 wrote to memory of 2472	2196	FUCKER.exe	29
PID 2196 wrote to memory of 2472	2196	FUCKER.exe	29
PID 2472 wrote to memory of 1660	2472	dsdasda.exe	30
PID 2472 wrote to memory of 1660	2472	dsdasda.exe	30
PID 2472 wrote to memory of 1660	2472	dsdasda.exe	30
PID 2472 wrote to memory of 1660	2472	dsdasda.exe	30
PID 2196 wrote to memory of 1624	2196	FUCKER.exe	31
PID 2196 wrote to memory of 1624	2196	FUCKER.exe	31
PID 2196 wrote to memory of 1624	2196	FUCKER.exe	31
PID 2196 wrote to memory of 1624	2196	FUCKER.exe	31
PID 2196 wrote to memory of 2592	2196	FUCKER.exe	32
PID 2196 wrote to memory of 2592	2196	FUCKER.exe	32
PID 2196 wrote to memory of 2592	2196	FUCKER.exe	32
PID 2196 wrote to memory of 2592	2196	FUCKER.exe	32
PID 2196 wrote to memory of 2892	2196	FUCKER.exe	33
PID 2196 wrote to memory of 2892	2196	FUCKER.exe	33
PID 2196 wrote to memory of 2892	2196	FUCKER.exe	33
PID 2196 wrote to memory of 2892	2196	FUCKER.exe	33
PID 2592 wrote to memory of 1376	2592	hghgfhjfhmain.exe	36
PID 2592 wrote to memory of 1376	2592	hghgfhjfhmain.exe	36
PID 2592 wrote to memory of 1376	2592	hghgfhjfhmain.exe	36
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2892 wrote to memory of 2120	2892	boomlumma.exe	35
PID 2120 wrote to memory of 2016	2120	RegAsm.exe	38
PID 2120 wrote to memory of 2016	2120	RegAsm.exe	38
PID 2120 wrote to memory of 2016	2120	RegAsm.exe	38
PID 2120 wrote to memory of 2016	2120	RegAsm.exe	38
PID 2196 wrote to memory of 2784	2196	FUCKER.exe	39
PID 2196 wrote to memory of 2784	2196	FUCKER.exe	39
PID 2196 wrote to memory of 2784	2196	FUCKER.exe	39
PID 2196 wrote to memory of 2784	2196	FUCKER.exe	39
PID 2196 wrote to memory of 1640	2196	FUCKER.exe	40
PID 2196 wrote to memory of 1640	2196	FUCKER.exe	40
PID 2196 wrote to memory of 1640	2196	FUCKER.exe	40
PID 2196 wrote to memory of 1640	2196	FUCKER.exe	40
PID 2196 wrote to memory of 1884	2196	FUCKER.exe	41
PID 2196 wrote to memory of 1884	2196	FUCKER.exe	41
PID 2196 wrote to memory of 1884	2196	FUCKER.exe	41
PID 2196 wrote to memory of 1884	2196	FUCKER.exe	41
PID 2196 wrote to memory of 772	2196	FUCKER.exe	43
PID 2196 wrote to memory of 772	2196	FUCKER.exe	43
PID 2196 wrote to memory of 772	2196	FUCKER.exe	43
PID 2196 wrote to memory of 772	2196	FUCKER.exe	43
PID 772 wrote to memory of 1900	772	RtkAudUKZ1.exe	44
PID 772 wrote to memory of 1900	772	RtkAudUKZ1.exe	44
PID 772 wrote to memory of 1900	772	RtkAudUKZ1.exe	44
PID 772 wrote to memory of 1816	772	RtkAudUKZ1.exe	45
PID 772 wrote to memory of 1816	772	RtkAudUKZ1.exe	45
PID 772 wrote to memory of 1816	772	RtkAudUKZ1.exe	45
PID 772 wrote to memory of 1532	772	RtkAudUKZ1.exe	46
PID 772 wrote to memory of 1532	772	RtkAudUKZ1.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FUCKER.exe
"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 600
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1660
- C:\Users\Admin\AppData\Local\Temp\Files\FirstZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\FirstZ.exe"
  2⤵
  - Executes dropped EXE
  PID:1624
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1468
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3064
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2420
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2884
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3052
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:1096
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1756
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:3036
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:872
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    PID:1800
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    PID:2484
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "WSNKISKT"
    3⤵
    - Launches sc.exe
    PID:2576
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2032
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2220
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "WSNKISKT"
    3⤵
    - Launches sc.exe
    PID:1924
- C:\Users\Admin\AppData\Local\Temp\Files\hghgfhjfhmain.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\hghgfhjfhmain.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "fgfdhdgg" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\gfgfgf\gfdgfdg.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1376
- C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 256
      4⤵
      Program crash
      PID:2016
- C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe"
  2⤵
  - Executes dropped EXE
  PID:2784
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    3⤵
    PID:2616
- C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:1640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 584
    3⤵
    - Program crash
    PID:1260
- C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Users\Admin\AppData\Local\Temp\Files\RtkAudUKZ1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\RtkAudUKZ1.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Control.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Control.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Anyns.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Anyns.exe
      4⤵
      PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Header.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Header.exe
      4⤵
      PID:1512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Files
    3⤵
    PID:1728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Files
      4⤵
      PID:3036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\
      4⤵
      PID:2548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Taskhost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Taskhost.exe
      4⤵
      PID:2680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Runtime.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Runtime.exe
      4⤵
      PID:2412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\Sideload\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\Sideload\
      4⤵
      PID:2456
- - C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Control.exe
    "C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Control.exe"
    3⤵
    PID:2012
- - C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Anyns.exe
    "C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Anyns.exe"
    3⤵
    PID:2764
- C:\Users\Admin\AppData\Local\Temp\Files\hv.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"
  2⤵
  PID:2432
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    3⤵
    PID:2968
- C:\Users\Admin\AppData\Local\Temp\Files\koooooo.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\koooooo.exe"
  2⤵
  PID:2156
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 560
    3⤵
    - Program crash
    PID:2632
- C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"
  2⤵
  PID:2620
- C:\Users\Admin\AppData\Local\Temp\Files\tidex_-_short_stuff.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tidex_-_short_stuff.exe"
  2⤵
  PID:308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 460
    3⤵
    - Program crash
    PID:2000
- C:\Users\Admin\AppData\Local\Temp\Files\ISetup5.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ISetup5.exe"
  2⤵
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\u28k.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u28k.0.exe"
    3⤵
    PID:2400
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AAFIJKKEHJ.exe"
      4⤵
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\AAFIJKKEHJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AAFIJKKEHJ.exe"
        5⤵
        
        PID:2944
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\AAFIJKKEHJ.exe
        6⤵
        
        PID:864
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        7⤵
        Runs ping.exe
        
        PID:2340
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KKEHIEBKJK.exe"
      4⤵
      PID:952
- - C:\Users\Admin\AppData\Local\Temp\u28k.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u28k.1.exe"
    3⤵
    PID:2604
- C:\Users\Admin\AppData\Local\Temp\Files\fud.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\fud.exe"
  2⤵
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
    "C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"
    3⤵
    PID:2440
- C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
  2⤵
  PID:2516
- C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe"
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe
    3⤵
    PID:2040
  - - C:\Windows\SysWOW64\PING.EXE
      ping 2.2.2.2 -n 1 -w 3000
      4⤵
      Runs ping.exe
      PID:1956
- C:\Users\Admin\AppData\Local\Temp\Files\lummahelp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\lummahelp.exe"
  2⤵
  PID:2876
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 252
      4⤵
      Program crash
      PID:2028
- C:\Users\Admin\AppData\Local\Temp\Files\Max.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Max.exe"
  2⤵
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\Files\crypted_15a94542.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\crypted_15a94542.exe"
  2⤵
  PID:2580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2984
- C:\Users\Admin\AppData\Local\Temp\Files\TJeAjWEEeH.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\TJeAjWEEeH.exe"
  2⤵
  PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
    3⤵
    PID:2124
- C:\Users\Admin\AppData\Local\Temp\Files\juditttt.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\juditttt.exe"
  2⤵
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\onefile_1920_133571325990190000\stub.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\juditttt.exe"
    3⤵
    PID:556
- C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe"
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\clip.exe
    "C:\Windows\SysWOW64\clip.exe"
    3⤵
    PID:2624
  - - C:\Users\Admin\AppData\Roaming\System32\taskhost.exe
      "C:\Users\Admin\AppData\Roaming\System32\taskhost.exe"
      4⤵
      PID:2244
- C:\Users\Admin\AppData\Local\Temp\Files\niks.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\niks.exe"
  2⤵
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\Files\mk.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\mk.exe"
  2⤵
  PID:2304
- C:\Users\Admin\AppData\Local\Temp\Files\native.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\native.exe"
  2⤵
  PID:1484
- C:\Users\Admin\AppData\Local\Temp\Files\file300un-1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\file300un-1.exe"
  2⤵
  PID:2892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
    3⤵
    PID:2020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:2784
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
    3⤵
    PID:2108
  - - C:\Users\Admin\Pictures\mwsPoDEpmOp2TiZIT377BcHq.exe
      "C:\Users\Admin\Pictures\mwsPoDEpmOp2TiZIT377BcHq.exe"
      4⤵
      PID:352
    - - C:\Users\Admin\AppData\Local\Temp\u9s.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u9s.0.exe"
        5⤵
        
        PID:2412
  - - C:\Users\Admin\Pictures\UrcGgJ10JMw6iw0OHVzsuRsn.exe
      "C:\Users\Admin\Pictures\UrcGgJ10JMw6iw0OHVzsuRsn.exe"
      4⤵
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\u1bk.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u1bk.0.exe"
        5⤵
        
        PID:3428
  - - C:\Users\Admin\Pictures\uF7dOdZWjV3GT7Wb1dsZ662y.exe
      "C:\Users\Admin\Pictures\uF7dOdZWjV3GT7Wb1dsZ662y.exe"
      4⤵
      PID:2144
- C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
  2⤵
  PID:1360
- C:\Users\Admin\AppData\Local\Temp\Files\VLTKNhatRac.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\VLTKNhatRac.exe"
  2⤵
  PID:948
- C:\Users\Admin\AppData\Local\Temp\Files\AUTOKEY.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\AUTOKEY.exe"
  2⤵
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
  2⤵
  PID:580
- C:\Users\Admin\AppData\Local\Temp\Files\SystemUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\SystemUpdate.exe"
  2⤵
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\sc.exe"
  2⤵
  - Launches sc.exe
  PID:612
- C:\Users\Admin\AppData\Local\Temp\Files\123p.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\123p.exe"
  2⤵
  PID:2868
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:872
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:1556
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    PID:2460
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    PID:2420
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "OBGPQMHF"
    3⤵
    - Launches sc.exe
    PID:2124
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1712
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "OBGPQMHF"
    3⤵
    - Launches sc.exe
    PID:2856
- C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe"
  2⤵
  PID:2112
- C:\Users\Admin\AppData\Local\Temp\Files\ce0b953269c74bc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ce0b953269c74bc.exe"
  2⤵
  PID:292
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4068
- C:\Users\Admin\AppData\Local\Temp\Files\AppGate2103v01.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\AppGate2103v01.exe"
  2⤵
  PID:3140

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
PID:764
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:824
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2308
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2572
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2656
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1608
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2672
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2516
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:2100
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:2444
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:2892
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:2640
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:904
- - C:\ProgramData\wikombernizc\reakuqnanrkn.exe
    "C:\ProgramData\wikombernizc\reakuqnanrkn.exe"
    3⤵
    PID:1604
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      PID:1404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:320
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2672
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:1040
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:2052
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:1996
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:592
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:2364
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:2588
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:2904
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:2244
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:2140
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:2560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508
1⤵
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

CNSWA.exe

Path C:\ProgramData\Chrome\CNSWA.exe
Size 37.1MB
SHA256 263a4d5c1dd9ddaf2f466008c3e188448ff53bec48220e063d686a8b5ab27a5f
MD5 55056a354010e2d3efccfcc90d507b5b
SHA1 a8887594be566a5b8cbd9cb9b03fdc419d9de7cb
SHA512 83f494960608f8160778286439c38f9bdd39e0965e5d3e82b04858be871e6693f54d5af915a0ddb6c7cdc35f13f72aefb739b10f77aa8e8ef6f3b30b7606a650
SSDEEP 12288:TDX6EUtFA+RLxx6aLm05opfN+0gr3FMWrMZXAzz77xQaoS:TbDUtm+hxx6aLo5snaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.ServiceHub.Anyns.exe

Path C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Anyns.exe
Size 45KB
SHA256 c21d1dd6391ae93398507c94f9b075dbe8baceed4903a78b3f6bebfa85cd155e
MD5 310b982faa6a9c8473c6a6097a64317f
SHA1 abdc0ee76d9f21d318c04b12cbbb4453c18a4c57
SHA512 e9434ff38d01f8983febbd7a4cafeaa4b2f11166adee44a4f6e10a9c25c265e0cefbe7c7a43dd38a3c77bdebdf662e98311184595e52419c03666658a0a4cb8c
SSDEEP 768:huyRNTAoZjRWUJs9bmo2qLxAuXuPeD58vnPIM9zjbggX36PV/n8vvmv4Rk4oTeBf:huyRNTAGo2Ju7D5iAM93bHXK9/n8mQRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.ServiceHub.Control.exe

Path C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Control.exe
Size 3.1MB
SHA256 50684cb3400e3cd4959c2ccd2dd900a157ef3163179adcf8da15ed5b7b41694b
MD5 7b9d9f41d274ddd8fac0544e188ade4a
SHA1 20050de536fbf27cdbfbdd0671af913e04106363
SHA512 c102873fa15ffd776ab17b16cd39d6ac95c8412dc8c4a0c8c28e1579dd0d03f9fa4f4985d419a76cd4853c5769ea4e95a24c4c1a9c61c98b7508d97c13b345af
SSDEEP 49152:zv2I22SsaNYfdPBldt698dBcjHXaRJ6qbR3LoGd1THHB72eh2NT:zvb22SsaNYfdPBldt6+dBcjHXaRJ6E
MD5 SHA1 SHA512 SSDEEP

Submit Download