amadey | 03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0

Processes:

file300un.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0"	file300un.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exechrosha.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

114 800 rundll32.exe
115 4444 rundll32.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 3 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exe

pid process

5348 netsh.exe
5896 netsh.exe
6012 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
114	800	rundll32.exe
115	4444	rundll32.exe

pid	process
5348	netsh.exe
5896	netsh.exe
6012	netsh.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exechrosha.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

chrosha.exeRegAsm.exeNewB.exeISetup8.exefile300un.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	chrosha.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	NewB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	ISetup8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	file300un.exe

Executes dropped EXE 17 IoCs

Processes:

chrosha.exeswiiiii.exealexxxxxxxx.exekeks.exetrf.exegold.exeNewB.exeISetup8.exejok.exetoolspub1.exeu3fk.0.exeswiiii.exe4767d2e713f2021e8fe856e3ea638b58.exefile300un.exeNewB.exeMjC3Ls3cFBX5dT6FLyA0D5HH.exeKOJjgsKnBGcarEFpfajKambQ.exe

pid	process
3736	chrosha.exe
1620	swiiiii.exe
4988	alexxxxxxxx.exe
3576	keks.exe
3400	trf.exe
4816	gold.exe
1016	NewB.exe
4448	ISetup8.exe
5016	jok.exe
4552	toolspub1.exe
4300	u3fk.0.exe
3032	swiiii.exe
3620	4767d2e713f2021e8fe856e3ea638b58.exe
4072	file300un.exe
2780	NewB.exe
1520	MjC3Ls3cFBX5dT6FLyA0D5HH.exe
4992	KOJjgsKnBGcarEFpfajKambQ.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exechrosha.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine	03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe
Key opened	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine	chrosha.exe

Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

4332 rundll32.exe
800 rundll32.exe
4444 rundll32.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4332	rundll32.exe
800	rundll32.exe
4444	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

file300un.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0"	file300un.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

file300un.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

190 pastebin.com
192 pastebin.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exechrosha.exe

pid process

740 03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe
3736 chrosha.exe

flow	ioc
190	pastebin.com
192	pastebin.com

Suspicious use of SetThreadContext 5 IoCs

Processes:

swiiiii.exealexxxxxxxx.exegold.exeswiiii.exefile300un.exe

description	pid	process	target process
PID 1620 set thread context of 2536	1620	swiiiii.exe	RegAsm.exe
PID 4988 set thread context of 3660	4988	alexxxxxxxx.exe	RegAsm.exe
PID 4816 set thread context of 3548	4816	gold.exe	RegAsm.exe
PID 3032 set thread context of 4552	3032	swiiii.exe	RegAsm.exe
PID 4072 set thread context of 3816	4072	file300un.exe	AddInProcess32.exe

Drops file in Windows directory 1 IoCs

Processes:

03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe

description ioc process

File created C:\Windows\Tasks\chrosha.job 03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

4136 sc.exe
6080 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\chrosha.job	03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe

pid	process
4136	sc.exe
6080	sc.exe

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3980	1620	WerFault.exe	swiiiii.exe
2748	4988	WerFault.exe	alexxxxxxxx.exe
3996	4816	WerFault.exe	gold.exe
4164	4552	WerFault.exe	toolspub1.exe
4164	4300	WerFault.exe	u3fk.0.exe
5420	3620	WerFault.exe	4767d2e713f2021e8fe856e3ea638b58.exe
5152	1520	WerFault.exe	MjC3Ls3cFBX5dT6FLyA0D5HH.exe
3356	6096	WerFault.exe	KOJjgsKnBGcarEFpfajKambQ.exe
5568	5232	WerFault.exe	u4oo.0.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

toolspub1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

908 schtasks.exe
5396 schtasks.exe

pid	process
908	schtasks.exe
5396	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

keks.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	keks.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	keks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exechrosha.exerundll32.exepowershell.exekeks.exetrf.exepowershell.exepowershell.exejok.exeRegAsm.exepowershell.exe

pid	process
740	03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe
740	03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe
3736	chrosha.exe
3736	chrosha.exe
800	rundll32.exe
800	rundll32.exe
800	rundll32.exe
800	rundll32.exe
800	rundll32.exe
800	rundll32.exe
800	rundll32.exe
800	rundll32.exe
800	rundll32.exe
800	rundll32.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
3576	keks.exe
3576	keks.exe
3400	trf.exe
3400	trf.exe
624	powershell.exe
624	powershell.exe
3288	powershell.exe
3288	powershell.exe
624	powershell.exe
3288	powershell.exe
5016	jok.exe
5016	jok.exe
5016	jok.exe
5016	jok.exe
4552	RegAsm.exe
4552	RegAsm.exe
5016	jok.exe
5016	jok.exe
3368	powershell.exe
3368	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

powershell.exetrf.exekeks.exefile300un.exeAddInProcess32.exepowershell.exepowershell.exejok.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	3400	trf.exe
Token: SeBackupPrivilege	3400	trf.exe
Token: SeSecurityPrivilege	3400	trf.exe
Token: SeSecurityPrivilege	3400	trf.exe
Token: SeSecurityPrivilege	3400	trf.exe
Token: SeSecurityPrivilege	3400	trf.exe
Token: SeDebugPrivilege	3576	keks.exe
Token: SeDebugPrivilege	4072	file300un.exe
Token: SeDebugPrivilege	3816	AddInProcess32.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeDebugPrivilege	5016	jok.exe
Token: SeDebugPrivilege	3368	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrosha.exeswiiiii.exerundll32.exerundll32.exealexxxxxxxx.exeRegAsm.exegold.exeNewB.exe

description	pid	process	target process
PID 3736 wrote to memory of 1620	3736	chrosha.exe	swiiiii.exe
PID 3736 wrote to memory of 1620	3736	chrosha.exe	swiiiii.exe
PID 3736 wrote to memory of 1620	3736	chrosha.exe	swiiiii.exe
PID 1620 wrote to memory of 2536	1620	swiiiii.exe	RegAsm.exe
PID 1620 wrote to memory of 2536	1620	swiiiii.exe	RegAsm.exe
PID 1620 wrote to memory of 2536	1620	swiiiii.exe	RegAsm.exe
PID 1620 wrote to memory of 2536	1620	swiiiii.exe	RegAsm.exe
PID 1620 wrote to memory of 2536	1620	swiiiii.exe	RegAsm.exe
PID 1620 wrote to memory of 2536	1620	swiiiii.exe	RegAsm.exe
PID 1620 wrote to memory of 2536	1620	swiiiii.exe	RegAsm.exe
PID 1620 wrote to memory of 2536	1620	swiiiii.exe	RegAsm.exe
PID 1620 wrote to memory of 2536	1620	swiiiii.exe	RegAsm.exe
PID 3736 wrote to memory of 4332	3736	chrosha.exe	rundll32.exe
PID 3736 wrote to memory of 4332	3736	chrosha.exe	rundll32.exe
PID 3736 wrote to memory of 4332	3736	chrosha.exe	rundll32.exe
PID 4332 wrote to memory of 800	4332	rundll32.exe	rundll32.exe
PID 4332 wrote to memory of 800	4332	rundll32.exe	rundll32.exe
PID 800 wrote to memory of 1268	800	rundll32.exe	netsh.exe
PID 800 wrote to memory of 1268	800	rundll32.exe	netsh.exe
PID 800 wrote to memory of 5028	800	rundll32.exe	powershell.exe
PID 800 wrote to memory of 5028	800	rundll32.exe	powershell.exe
PID 3736 wrote to memory of 4444	3736	chrosha.exe	rundll32.exe
PID 3736 wrote to memory of 4444	3736	chrosha.exe	rundll32.exe
PID 3736 wrote to memory of 4444	3736	chrosha.exe	rundll32.exe
PID 3736 wrote to memory of 4988	3736	chrosha.exe	alexxxxxxxx.exe
PID 3736 wrote to memory of 4988	3736	chrosha.exe	alexxxxxxxx.exe
PID 3736 wrote to memory of 4988	3736	chrosha.exe	alexxxxxxxx.exe
PID 4988 wrote to memory of 3660	4988	alexxxxxxxx.exe	RegAsm.exe
PID 4988 wrote to memory of 3660	4988	alexxxxxxxx.exe	RegAsm.exe
PID 4988 wrote to memory of 3660	4988	alexxxxxxxx.exe	RegAsm.exe
PID 4988 wrote to memory of 3660	4988	alexxxxxxxx.exe	RegAsm.exe
PID 4988 wrote to memory of 3660	4988	alexxxxxxxx.exe	RegAsm.exe
PID 4988 wrote to memory of 3660	4988	alexxxxxxxx.exe	RegAsm.exe
PID 4988 wrote to memory of 3660	4988	alexxxxxxxx.exe	RegAsm.exe
PID 4988 wrote to memory of 3660	4988	alexxxxxxxx.exe	RegAsm.exe
PID 3660 wrote to memory of 3576	3660	RegAsm.exe	keks.exe
PID 3660 wrote to memory of 3576	3660	RegAsm.exe	keks.exe
PID 3660 wrote to memory of 3576	3660	RegAsm.exe	keks.exe
PID 3660 wrote to memory of 3400	3660	RegAsm.exe	trf.exe
PID 3660 wrote to memory of 3400	3660	RegAsm.exe	trf.exe
PID 3736 wrote to memory of 4816	3736	chrosha.exe	gold.exe
PID 3736 wrote to memory of 4816	3736	chrosha.exe	gold.exe
PID 3736 wrote to memory of 4816	3736	chrosha.exe	gold.exe
PID 4816 wrote to memory of 4428	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 4428	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 4428	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 3548	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 3548	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 3548	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 3548	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 3548	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 3548	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 3548	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 3548	4816	gold.exe	RegAsm.exe
PID 4816 wrote to memory of 3548	4816	gold.exe	RegAsm.exe
PID 3736 wrote to memory of 1016	3736	chrosha.exe	NewB.exe
PID 3736 wrote to memory of 1016	3736	chrosha.exe	NewB.exe
PID 3736 wrote to memory of 1016	3736	chrosha.exe	NewB.exe
PID 1016 wrote to memory of 908	1016	NewB.exe	schtasks.exe
PID 1016 wrote to memory of 908	1016	NewB.exe	schtasks.exe
PID 1016 wrote to memory of 908	1016	NewB.exe	schtasks.exe
PID 1016 wrote to memory of 4448	1016	NewB.exe	ISetup8.exe
PID 1016 wrote to memory of 4448	1016	NewB.exe	ISetup8.exe
PID 1016 wrote to memory of 4448	1016	NewB.exe	ISetup8.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

file300un.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file300un.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

C:\Users\Admin\AppData\Local\Temp\03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe
"C:\Users\Admin\AppData\Local\Temp\03025185db7ff2b3f7faeeb2f600274a8c87011ae7c2771f11df5be956a228e0.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:740

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 868
    3⤵
    - Program crash
    PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:1268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084619521222_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5028
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:4444
- C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3576
  - - C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3400
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:5612
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:5824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 360
    3⤵
    - Program crash
    PID:2748
- C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
  "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4428
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 364
    3⤵
    - Program crash
    PID:3996
- C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:908
- - C:\Users\Admin\AppData\Local\Temp\1000223001\ISetup8.exe
    "C:\Users\Admin\AppData\Local\Temp\1000223001\ISetup8.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\u3fk.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u3fk.0.exe"
      4⤵
      Executes dropped EXE
      PID:4300
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 1016
        5⤵
        Program crash
        
        PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\u3fk.2\run.exe
      "C:\Users\Admin\AppData\Local\Temp\u3fk.2\run.exe"
      4⤵
      PID:5716
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        
        PID:3404
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        
        PID:5840
- - C:\Users\Admin\AppData\Local\Temp\1000224001\toolspub1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000224001\toolspub1.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 356
      4⤵
      Program crash
      PID:4164
- - C:\Users\Admin\AppData\Local\Temp\1000225001\4767d2e713f2021e8fe856e3ea638b58.exe
    "C:\Users\Admin\AppData\Local\Temp\1000225001\4767d2e713f2021e8fe856e3ea638b58.exe"
    3⤵
    - Executes dropped EXE
    PID:3620
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\1000225001\4767d2e713f2021e8fe856e3ea638b58.exe
      "C:\Users\Admin\AppData\Local\Temp\1000225001\4767d2e713f2021e8fe856e3ea638b58.exe"
      4⤵
      PID:5332
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:5792
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:5348
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5212
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5176
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:5944
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:3668
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:5396
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:5564
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:3204
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:4712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 936
      4⤵
      Program crash
      PID:5420
- C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
  "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3732
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4552
- C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
  "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:4072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:624
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
    3⤵
    PID:3860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
  - - C:\Users\Admin\Pictures\MjC3Ls3cFBX5dT6FLyA0D5HH.exe
      "C:\Users\Admin\Pictures\MjC3Ls3cFBX5dT6FLyA0D5HH.exe"
      4⤵
      Executes dropped EXE
      PID:1520
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
    - - C:\Users\Admin\Pictures\MjC3Ls3cFBX5dT6FLyA0D5HH.exe
        
        "C:\Users\Admin\Pictures\MjC3Ls3cFBX5dT6FLyA0D5HH.exe"
        5⤵
        
        PID:3032
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5524
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        
        PID:3288
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:6012
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:3080
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 800
        5⤵
        Program crash
        
        PID:5152
  - - C:\Users\Admin\Pictures\KOJjgsKnBGcarEFpfajKambQ.exe
      "C:\Users\Admin\Pictures\KOJjgsKnBGcarEFpfajKambQ.exe"
      4⤵
      Executes dropped EXE
      PID:4992
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:752
    - - C:\Users\Admin\Pictures\KOJjgsKnBGcarEFpfajKambQ.exe
        
        "C:\Users\Admin\Pictures\KOJjgsKnBGcarEFpfajKambQ.exe"
        5⤵
        
        PID:6096
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        
        PID:1964
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:5896
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:3668
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3368
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 892
        6⤵
        Program crash
        
        PID:3356
  - - C:\Users\Admin\Pictures\pzbDlMTbZAB0Zds84duJ6QpA.exe
      "C:\Users\Admin\Pictures\pzbDlMTbZAB0Zds84duJ6QpA.exe"
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\u4oo.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4oo.0.exe"
        5⤵
        
        PID:5232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 1016
        6⤵
        Program crash
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\u4oo.2\run.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4oo.2\run.exe"
        5⤵
        
        PID:5664
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        
        PID:5212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:1740
- C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
  "C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"
  2⤵
  PID:5288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "
    3⤵
    PID:5348
  - - C:\Windows\SysWOW64\sc.exe
      Sc delete GameServerClient
      4⤵
      Launches sc.exe
      PID:4136
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService remove GameServerClient confirm
      4⤵
      PID:3904
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
      4⤵
      PID:4556
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService start GameServerClient
      4⤵
      PID:3288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
    3⤵
    PID:3080
  - - C:\Windows\SysWOW64\sc.exe
      Sc delete GameServerClientC
      4⤵
      Launches sc.exe
      PID:6080
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService remove GameServerClientC confirm
      4⤵
      PID:5940
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
      4⤵
      PID:1044
  - - C:\Program Files (x86)\GameServerClient\GameService.exe
      GameService start GameServerClientC
      4⤵
      PID:3224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
    3⤵
    PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1620 -ip 1620
1⤵
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4988 -ip 4988
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4816 -ip 4816
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4552 -ip 4552
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4300 -ip 4300
1⤵
PID:3668

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
- Executes dropped EXE
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3620 -ip 3620
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1520 -ip 1520
1⤵
PID:2672

C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
1⤵
PID:5836
- C:\Program Files (x86)\GameServerClient\GameServerClient.exe
  "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
  2⤵
  PID:2628
- - C:\Windows\Temp\761347.exe
    "C:\Windows\Temp\761347.exe" --list-devices
    3⤵
    PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6096 -ip 6096
1⤵
PID:5028

C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
1⤵
PID:5508
- C:\Program Files (x86)\GameServerClient\GameServerClientC.exe
  "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
  2⤵
  PID:6020
- - C:\Windows\Temp\263715.exe
    "C:\Windows\Temp\263715.exe" --coin BTC -m ADDRESSES -t 0 --range 27764869860000000:27764869880000000 -o xxx0.txt -i C:\Windows\Temp\curjob.bin
    3⤵
    PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5232 -ip 5232
1⤵
PID:3992

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
PID:5416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion