amadey | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral3/files/0x0003000000000741-1513.dat	WebBrowserPassView

Nirsoft 1 IoCs

resource	yara_rule
behavioral3/files/0x0003000000000741-1513.dat	Nirsoft

Dave packer 1 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

resource	yara_rule
behavioral3/files/0x0007000000023216-105.dat	dave

Downloads MZ/PE file

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral3/files/0x000900000002326d-1193.dat	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	FUCKER.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	build6_unencrypted.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\retero.exe	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\retero.exe	DllHost.exe

Executes dropped EXE 7 IoCs

pid	Process
2776	amert.exe
720	TrueCrypt_nKJqAu.exe
3156	html.exe
3468	win.exe
400	build6_unencrypted.exe
2332	Tdkdsxz.exe
960	Yellow%20Pages%20Scraper.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Wine	amert.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/0x00070000000232fe-1457.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
278	bitbucket.org
280	bitbucket.org
308	pastebin.com
309	pastebin.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
160	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2776	amert.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 720 set thread context of 3828	720	TrueCrypt_nKJqAu.exe	101

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	amert.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
7340	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral3/files/0x000800000002326c-1026.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2248	3924	WerFault.exe	113
5300	4092	WerFault.exe	128
5612	5788	WerFault.exe	138
5504	2224	WerFault.exe	114
6552	5324	WerFault.exe	136
7592	7852	WerFault.exe	270

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
388	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
6264	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
6112	WMIC.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
6512	tasklist.exe
2880	tasklist.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
6736	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6760	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
400	build6_unencrypted.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2776	amert.exe
2776	amert.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3156	html.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe
3828	ADelRCP.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3808	FUCKER.exe
Token: SeDebugPrivilege	400	build6_unencrypted.exe
Token: SeDebugPrivilege	5108	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	amert.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 2776	3808	FUCKER.exe	91
PID 3808 wrote to memory of 2776	3808	FUCKER.exe	91
PID 3808 wrote to memory of 2776	3808	FUCKER.exe	91
PID 3808 wrote to memory of 720	3808	FUCKER.exe	94
PID 3808 wrote to memory of 720	3808	FUCKER.exe	94
PID 3808 wrote to memory of 3156	3808	FUCKER.exe	97
PID 3808 wrote to memory of 3156	3808	FUCKER.exe	97
PID 3808 wrote to memory of 3156	3808	FUCKER.exe	97
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 3156 wrote to memory of 3908	3156	html.exe	100
PID 720 wrote to memory of 3828	720	TrueCrypt_nKJqAu.exe	101
PID 720 wrote to memory of 3828	720	TrueCrypt_nKJqAu.exe	101
PID 720 wrote to memory of 3828	720	TrueCrypt_nKJqAu.exe	101
PID 720 wrote to memory of 3828	720	TrueCrypt_nKJqAu.exe	101
PID 720 wrote to memory of 3828	720	TrueCrypt_nKJqAu.exe	101
PID 3808 wrote to memory of 3468	3808	FUCKER.exe	102
PID 3808 wrote to memory of 3468	3808	FUCKER.exe	102
PID 3808 wrote to memory of 3468	3808	FUCKER.exe	102
PID 3808 wrote to memory of 400	3808	FUCKER.exe	103
PID 3808 wrote to memory of 400	3808	FUCKER.exe	103
PID 400 wrote to memory of 5108	400	build6_unencrypted.exe	104
PID 400 wrote to memory of 5108	400	build6_unencrypted.exe	104
PID 3808 wrote to memory of 2332	3808	FUCKER.exe	107
PID 3808 wrote to memory of 2332	3808	FUCKER.exe	107
PID 3808 wrote to memory of 2332	3808	FUCKER.exe	107
PID 3808 wrote to memory of 960	3808	FUCKER.exe	108
PID 3808 wrote to memory of 960	3808	FUCKER.exe	108
PID 3808 wrote to memory of 960	3808	FUCKER.exe	108

C:\Users\Admin\AppData\Local\Temp\FUCKER.exe
"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\Files\TrueCrypt_nKJqAu.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\TrueCrypt_nKJqAu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3828
- C:\Users\Admin\AppData\Local\Temp\Files\html.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\html.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\html.exe"
    3⤵
    PID:3908
- C:\Users\Admin\AppData\Local\Temp\Files\win.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\win.exe"
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Users\Admin\AppData\Local\Temp\Files\build6_unencrypted.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\build6_unencrypted.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'build6_unencrypted.exe'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\build6_unencrypted.exe'
    3⤵
    PID:4408
- C:\Users\Admin\AppData\Local\Temp\Files\Tdkdsxz.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Tdkdsxz.exe"
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Users\Admin\AppData\Local\Temp\Files\lenin.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\lenin.exe"
  2⤵
  PID:4616
- C:\Users\Admin\AppData\Local\Temp\Files\e0cbefcb1af40c7d4aff4aca26621a98.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\e0cbefcb1af40c7d4aff4aca26621a98.exe"
  2⤵
  PID:4100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:5456
- C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"
  2⤵
  PID:3924
- - C:\Users\Admin\AppData\Local\Temp\u310.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u310.0.exe"
    3⤵
    PID:2224
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HCAKFBGCBF.exe"
      4⤵
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\HCAKFBGCBF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HCAKFBGCBF.exe"
        5⤵
        
        PID:5736
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\HCAKFBGCBF.exe
        6⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        7⤵
        Runs ping.exe
        
        PID:6760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 2200
      4⤵
      Program crash
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\u310.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u310.1.exe"
    3⤵
    PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
      "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
      4⤵
      PID:5372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 1420
    3⤵
    - Program crash
    PID:2248
- C:\Users\Admin\AppData\Local\Temp\Files\zxcvb.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\zxcvb.exe"
  2⤵
  PID:2176
- C:\Users\Admin\AppData\Local\Temp\Files\BrawlB0t.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\BrawlB0t.exe"
  2⤵
  PID:4416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\BrawlB0t.exe'
    3⤵
    PID:3520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BrawlB0t.exe'
    3⤵
    PID:7096
- C:\Users\Admin\AppData\Local\Temp\Files\output_64.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\output_64.exe"
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\Files\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\alexxxxxxxx.exe"
  2⤵
  PID:2980
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1848
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      PID:5200
- C:\Users\Admin\AppData\Local\Temp\Files\ISetup5.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ISetup5.exe"
  2⤵
  PID:4092
- - C:\Users\Admin\AppData\Local\Temp\u35o.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u35o.0.exe"
    3⤵
    PID:5324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 1216
      4⤵
      Program crash
      PID:6552
- - C:\Users\Admin\AppData\Local\Temp\u35o.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u35o.1.exe"
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 1532
    3⤵
    - Program crash
    PID:5300
- C:\Users\Admin\AppData\Local\Temp\Files\cacd6bf810543a9d46c9b104dfd72778.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cacd6bf810543a9d46c9b104dfd72778.exe"
  2⤵
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Files\Hero.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Hero.exe"
    3⤵
    PID:5992
- C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
  2⤵
  PID:5404
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    3⤵
    PID:6524
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'kwweifjdskdv';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'kwweifjdskdv' -Value '"C:\Users\Admin\AppData\Local\kwweifjdskdv\kwweifjdskdv.exe"' -PropertyType 'String'
    3⤵
    PID:6396
- C:\Users\Admin\AppData\Local\Temp\Files\koooooo.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\koooooo.exe"
  2⤵
  PID:5788
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 852
    3⤵
    - Program crash
    PID:5612
- C:\Users\Admin\AppData\Local\Temp\Files\swizzyy.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\swizzyy.exe"
  2⤵
  PID:5984
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5944
- C:\Users\Admin\AppData\Local\Temp\Files\dais123.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dais123.exe"
  2⤵
  PID:6116
- C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe"
  2⤵
  PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe"
    3⤵
    PID:4344
- C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
  2⤵
  PID:2936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6378.tmp.bat""
    3⤵
    PID:5108
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:6264
  - - C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
      "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
      4⤵
      PID:5012
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        5⤵
        
        PID:6536
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:388
- C:\Users\Admin\AppData\Local\Temp\Files\USA123.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\USA123.exe"
  2⤵
  PID:5168
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\Files\USA123.exe /f
    3⤵
    PID:5760
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\Files\USA123.exe /f
      4⤵
      Modifies registry key
      PID:6736
- C:\Users\Admin\AppData\Local\Temp\Files\images.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\images.exe"
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT /delete /yes
    3⤵
    PID:1580
  - - C:\Windows\SysWOW64\at.exe
      AT /delete /yes
      4⤵
      PID:6440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
    3⤵
    PID:6816
  - - C:\Windows\SysWOW64\at.exe
      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
      4⤵
      PID:6208
- C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"
  2⤵
  PID:5484
- - C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"
    3⤵
    PID:6320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:6148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6512
- C:\Users\Admin\AppData\Local\Temp\Files\hv.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"
  2⤵
  PID:7004
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    3⤵
    PID:6724
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Remove-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists';New-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists' -Value '"C:\Users\Admin\AppData\Local\LibraryApp_for_translators_and_linguists\LibraryApp_for_translators_and_linguists.exe"' -PropertyType 'String'
    3⤵
    PID:1464
- C:\Users\Admin\AppData\Local\Temp\Files\judith1234.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\judith1234.exe"
  2⤵
  PID:2604
- - C:\Users\Admin\AppData\Local\Temp\onefile_2604_133571324186246508\stub.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\judith1234.exe"
    3⤵
    PID:5808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:7032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:6344
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:6112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
      4⤵
      PID:6356
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        5⤵
        
        PID:7136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "gdb --version"
      4⤵
      PID:6340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:7044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
      4⤵
      PID:6804
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        5⤵
        
        PID:1604
- C:\Users\Admin\AppData\Local\Temp\Files\2.3.1.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\2.3.1.1.exe"
  2⤵
  PID:6876
- C:\Users\Admin\AppData\Local\Temp\Files\Runtime.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Runtime.exe"
  2⤵
  PID:4924
- C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe"
  2⤵
  PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe
    3⤵
    PID:5748
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 0
      4⤵
      PID:6896
- C:\Users\Admin\AppData\Local\Temp\Files\alex12.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\alex12.exe"
  2⤵
  PID:6596
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:6368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:6196
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4820
  - - C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe"
      4⤵
      PID:3984
- C:\Users\Admin\AppData\Local\Temp\Files\ps.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ps.exe"
  2⤵
  PID:2100
- C:\Users\Admin\AppData\Local\Temp\Files\conan.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\conan.exe"
  2⤵
  PID:5440
- C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
  2⤵
  PID:6100
- - C:\Users\Admin\AppData\Local\Temp\245341610.exe
    C:\Users\Admin\AppData\Local\Temp\245341610.exe
    3⤵
    PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\2903716859.exe
      C:\Users\Admin\AppData\Local\Temp\2903716859.exe
      4⤵
      PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\98283674.exe
        
        C:\Users\Admin\AppData\Local\Temp\98283674.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\621533012.exe
        
        C:\Users\Admin\AppData\Local\Temp\621533012.exe
        5⤵
        
        PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\1760415418.exe
      C:\Users\Admin\AppData\Local\Temp\1760415418.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\1880326226.exe
      C:\Users\Admin\AppData\Local\Temp\1880326226.exe
      4⤵
      PID:8384
- C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
  2⤵
  PID:5576
- C:\Users\Admin\AppData\Local\Temp\Files\Pac-Man.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Pac-Man.exe"
  2⤵
  PID:5564
- C:\Users\Admin\AppData\Local\Temp\Files\stub.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"
  2⤵
  PID:3632
- C:\Users\Admin\AppData\Local\Temp\Files\3.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\3.exe"
  2⤵
  PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Files\3.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\3.exe"
    3⤵
    PID:8000
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:7324
- C:\Users\Admin\AppData\Local\Temp\Files\lumma123142124.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\lumma123142124.exe"
  2⤵
  PID:6556
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:7552
- C:\Users\Admin\AppData\Local\Temp\Files\RtkAudUKZ1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\RtkAudUKZ1.exe"
  2⤵
  PID:7112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Control.exe
    3⤵
    PID:6828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Control.exe
      4⤵
      PID:7932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Anyns.exe
    3⤵
    PID:5536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Anyns.exe
      4⤵
      PID:7060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Header.exe
    3⤵
    PID:5508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Header.exe
      4⤵
      PID:5640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Files
    3⤵
    PID:5608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Files
      4⤵
      PID:7756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\
    3⤵
    PID:5232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\
      4⤵
      PID:5412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Taskhost.exe
    3⤵
    PID:5184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Taskhost.exe
      4⤵
      PID:2932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Runtime.exe
    3⤵
    PID:4536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Runtime.exe
      4⤵
      PID:6296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\Sideload\
    3⤵
    PID:2876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\Sideload\
      4⤵
      PID:8008
- C:\Users\Admin\AppData\Local\Temp\Files\native.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\native.exe"
  2⤵
  PID:6804
- C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\sc.exe"
  2⤵
  - Launches sc.exe
  PID:7340
- C:\Users\Admin\AppData\Local\Temp\Files\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1111.exe"
  2⤵
  PID:7852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7852 -s 156
    3⤵
    - Program crash
    PID:7592
- C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe"
  2⤵
  PID:8048
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hf0a2jbe.cmdline"
    3⤵
    PID:5660
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57CC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC57CB.tmp"
      4⤵
      PID:2312
- - C:\Windows\system32\chcp.com
    "C:\Windows\system32\chcp.com" 437
    3⤵
    PID:6368
- C:\Users\Admin\AppData\Local\Temp\Files\Tester.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Tester.exe"
  2⤵
  PID:7036
- C:\Users\Admin\AppData\Local\Temp\Files\socks5-clean.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\socks5-clean.exe"
  2⤵
  PID:7252
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass -File socks5-clean.ps1
    3⤵
    PID:8076

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3924 -ip 3924
1⤵
PID:4408

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  PID:6096
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    PID:5844
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:5356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\045580317372_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:6564
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  PID:6540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4092 -ip 4092
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5788 -ip 5788
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2224 -ip 2224
1⤵
PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5324 -ip 5324
1⤵
PID:6300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4d8 0x4e8
1⤵
PID:8068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7852 -ip 7852
1⤵
PID:5448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:8548

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:9020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery

Virtualization/Sandbox Evasion