amadey | 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1

Virtualization/Sandbox Evasion

Processes:

chrosha.exe77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exeamert.exee902973543.exeexplorta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e902973543.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

amert.exeexplorta.exe77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exechrosha.exee902973543.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e902973543.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e902973543.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exe611b2ae010.exechrosha.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	explorta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	611b2ae010.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	chrosha.exe

Executes dropped EXE 8 IoCs

Processes:

explorta.exeamert.exe611b2ae010.exee902973543.exeexplorta.exechrosha.exeswiiiii.exealexxxxxxxx.exe

pid process

224 explorta.exe
2504 amert.exe
4760 611b2ae010.exe
4660 e902973543.exe
5928 explorta.exe
5920 chrosha.exe
5312 swiiiii.exe
5440 alexxxxxxxx.exe

pid	process
224	explorta.exe
2504	amert.exe
4760	611b2ae010.exe
4660	e902973543.exe
5928	explorta.exe
5920	chrosha.exe
5312	swiiiii.exe
5440	alexxxxxxxx.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exeamert.exee902973543.exeexplorta.exechrosha.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	e902973543.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	chrosha.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Pictures\AUOJwzWUhuXoDRZSwm4I8Gsd.exe	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorta.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\611b2ae010.exe = "C:\\Users\\Admin\\1000013002\\611b2ae010.exe"	explorta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e902973543.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\e902973543.exe"	explorta.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

150 pastebin.com
151 pastebin.com
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

201 api.myip.com
202 api.myip.com
203 ipinfo.io
204 ipinfo.io

flow	ioc
150	pastebin.com
151	pastebin.com

flow	ioc
201	api.myip.com
202	api.myip.com
203	ipinfo.io
204	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\1000013002\611b2ae010.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exeamert.exee902973543.exechrosha.exeexplorta.exe

pid	process
4476	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
224	explorta.exe
2504	amert.exe
4660	e902973543.exe
5920	chrosha.exe
5928	explorta.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

swiiiii.exealexxxxxxxx.exe

description	pid	process	target process
PID 5312 set thread context of 5716	5312	swiiiii.exe	RegAsm.exe
PID 5440 set thread context of 5980	5440	alexxxxxxxx.exe	RegAsm.exe

Drops file in Windows directory 2 IoCs

Processes:

77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeamert.exe

description	ioc	process
File created	C:\Windows\Tasks\explorta.job	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
File created	C:\Windows\Tasks\chrosha.job	amert.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

6448 sc.exe
5596 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
6448	sc.exe
5596	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5216	5440	WerFault.exe	alexxxxxxxx.exe
5232	5312	WerFault.exe	swiiiii.exe
5892	6080	WerFault.exe	gold.exe
1488	6608	WerFault.exe	K9EzU2hxB6e4QfvrMT7LnkFP.exe
6940	7044	WerFault.exe	u53k.0.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5344 schtasks.exe
4568 schtasks.exe

pid	process
5344	schtasks.exe
4568	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585296532696232"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{B622DF68-10F4-491A-A0EC-30A314A16EE1}	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exeamert.exechrome.exee902973543.exeexplorta.exechrosha.exe

pid	process
4476	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
4476	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
224	explorta.exe
224	explorta.exe
2504	amert.exe
2504	amert.exe
3420	chrome.exe
3420	chrome.exe
4660	e902973543.exe
4660	e902973543.exe
5928	explorta.exe
5928	explorta.exe
5920	chrosha.exe
5920	chrosha.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

3420 chrome.exe
3420 chrome.exe
3420 chrome.exe
3420 chrome.exe

pid	process
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe

Suspicious use of FindShellTrayWindow 60 IoCs

Processes:

77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe611b2ae010.exechrome.exe

pid	process
4476	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
4760	611b2ae010.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
4760	611b2ae010.exe
3420	chrome.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe

Suspicious use of SendNotifyMessage 56 IoCs

Processes:

611b2ae010.exechrome.exe

pid	process
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
4760	611b2ae010.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe
4760	611b2ae010.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exe611b2ae010.exechrome.exe

description	pid	process	target process
PID 4476 wrote to memory of 224	4476	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe	explorta.exe
PID 4476 wrote to memory of 224	4476	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe	explorta.exe
PID 4476 wrote to memory of 224	4476	77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe	explorta.exe
PID 224 wrote to memory of 2528	224	explorta.exe	explorta.exe
PID 224 wrote to memory of 2528	224	explorta.exe	explorta.exe
PID 224 wrote to memory of 2528	224	explorta.exe	explorta.exe
PID 224 wrote to memory of 2504	224	explorta.exe	amert.exe
PID 224 wrote to memory of 2504	224	explorta.exe	amert.exe
PID 224 wrote to memory of 2504	224	explorta.exe	amert.exe
PID 224 wrote to memory of 4760	224	explorta.exe	611b2ae010.exe
PID 224 wrote to memory of 4760	224	explorta.exe	611b2ae010.exe
PID 224 wrote to memory of 4760	224	explorta.exe	611b2ae010.exe
PID 4760 wrote to memory of 3420	4760	611b2ae010.exe	chrome.exe
PID 4760 wrote to memory of 3420	4760	611b2ae010.exe	chrome.exe
PID 3420 wrote to memory of 4832	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 4832	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3296	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 1804	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 1804	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 4152	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 4152	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 4152	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 4152	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 4152	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 4152	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 4152	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 4152	3420	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
"C:\Users\Admin\AppData\Local\Temp\77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4476

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:224

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
3⤵
PID:2528

C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
"C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2504

C:\Users\Admin\1000013002\611b2ae010.exe
"C:\Users\Admin\1000013002\611b2ae010.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd770b9758,0x7ffd770b9768,0x7ffd770b9778
5⤵
PID:4832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:2
5⤵
PID:3296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:8
5⤵
PID:1804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:8
5⤵
PID:4152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:1
5⤵
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:1
5⤵
PID:1692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4560 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:1
5⤵
PID:4364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4840 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:1
5⤵
PID:5204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4816 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:8
5⤵
PID:5328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:8
5⤵
- Modifies registry class
PID:5336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:8
5⤵
PID:5548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1808,i,3428168854509103031,15954556880966478854,131072 /prefetch:8
5⤵
PID:5632

C:\Users\Admin\AppData\Local\Temp\1000014001\e902973543.exe
"C:\Users\Admin\AppData\Local\Temp\1000014001\e902973543.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4660

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4332

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5920

C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 876
3⤵
- Program crash
PID:5232

C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5980

C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
4⤵
PID:696

C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
4⤵
PID:5616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
4⤵
PID:6596

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 352
3⤵
- Program crash
PID:5216

C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
2⤵
PID:6080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 356
3⤵
- Program crash
PID:5892

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
2⤵
PID:5972

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
3⤵
- Creates scheduled task(s)
PID:5344

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
2⤵
PID:5484

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
3⤵
PID:5564

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:6080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal
4⤵
PID:5348

C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
2⤵
PID:1748

C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
2⤵
PID:464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5636

C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
2⤵
PID:5664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force
3⤵
PID:4996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
3⤵
PID:932

C:\Users\Admin\Pictures\K9EzU2hxB6e4QfvrMT7LnkFP.exe
"C:\Users\Admin\Pictures\K9EzU2hxB6e4QfvrMT7LnkFP.exe"
4⤵
PID:6608

C:\Users\Admin\AppData\Local\Temp\u53k.0.exe
"C:\Users\Admin\AppData\Local\Temp\u53k.0.exe"
5⤵
PID:7044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 1244
6⤵
- Program crash
PID:6940

C:\Users\Admin\AppData\Local\Temp\u53k.2\run.exe
"C:\Users\Admin\AppData\Local\Temp\u53k.2\run.exe"
5⤵
PID:5796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
6⤵
PID:2240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
7⤵
PID:5504

C:\Users\Admin\AppData\Local\Temp\u53k.3.exe
"C:\Users\Admin\AppData\Local\Temp\u53k.3.exe"
5⤵
PID:4584

C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
6⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 1144
5⤵
- Program crash
PID:1488

C:\Users\Admin\Pictures\dvziYrHzjJaIGccJldIN1TNj.exe
"C:\Users\Admin\Pictures\dvziYrHzjJaIGccJldIN1TNj.exe"
4⤵
PID:7008

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:5372

C:\Users\Admin\Pictures\S6gQXYO26TJ29VBYykARgxl8.exe
"C:\Users\Admin\Pictures\S6gQXYO26TJ29VBYykARgxl8.exe"
4⤵
PID:7068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:1488

C:\Users\Admin\Pictures\x1QvVUZFYeu0W5aS8JUXZFtT.exe
"C:\Users\Admin\Pictures\x1QvVUZFYeu0W5aS8JUXZFtT.exe" --silent --allusers=0
4⤵
PID:6740

C:\Users\Admin\Pictures\x1QvVUZFYeu0W5aS8JUXZFtT.exe
C:\Users\Admin\Pictures\x1QvVUZFYeu0W5aS8JUXZFtT.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x29c,0x2a0,0x2a4,0x274,0x2a8,0x6c42e1d0,0x6c42e1dc,0x6c42e1e8
5⤵
PID:3992

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\x1QvVUZFYeu0W5aS8JUXZFtT.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\x1QvVUZFYeu0W5aS8JUXZFtT.exe" --version
5⤵
PID:2212

C:\Users\Admin\Pictures\x1QvVUZFYeu0W5aS8JUXZFtT.exe
"C:\Users\Admin\Pictures\x1QvVUZFYeu0W5aS8JUXZFtT.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6740 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240425144159" --session-guid=f4cbfaa2-6eaf-471f-8e79-eb81698f826c --server-tracking-blob="MjAyMTM2YTAxMGY5N2I3M2E1MTRlOWNjZjAxMjU4NTI2MGU4OTgyYTE2MTU1Yzg3NmQ5NDU1Mzc1MTNlZGVmODp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MDU2MDk1LjI2MDMiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMDk3NzI2ZWYtMDBhNC00ZWZmLWEyMzYtZWFmYjlkMDdmNDBiIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=DC04000000000000
5⤵
PID:3048

C:\Users\Admin\Pictures\x1QvVUZFYeu0W5aS8JUXZFtT.exe
C:\Users\Admin\Pictures\x1QvVUZFYeu0W5aS8JUXZFtT.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x298,0x2a8,0x2ac,0x274,0x2b0,0x6b40e1d0,0x6b40e1dc,0x6b40e1e8
6⤵
PID:3212

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441591\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441591\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
5⤵
PID:5636

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441591\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441591\assistant\assistant_installer.exe" --version
5⤵
PID:7076

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441591\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441591\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0xd06038,0xd06044,0xd06050
6⤵
PID:6444

C:\Users\Admin\Pictures\AUOJwzWUhuXoDRZSwm4I8Gsd.exe
"C:\Users\Admin\Pictures\AUOJwzWUhuXoDRZSwm4I8Gsd.exe"
4⤵
PID:2856

C:\Users\Admin\Pictures\qljIlML54xtrmsfmXnFGGOr1.exe
"C:\Users\Admin\Pictures\qljIlML54xtrmsfmXnFGGOr1.exe"
4⤵
PID:4404

C:\Users\Admin\AppData\Local\Temp\7zS6B62.tmp\Install.exe
.\Install.exe /RvdidblCuX "385118" /S
5⤵
PID:1368

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
6⤵
PID:5432

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
PID:804

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
8⤵
PID:3028

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
9⤵
PID:1960

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 14:43:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\ULdqcYh.exe\" em /wwsite_idwFX 385118 /S" /V1 /F
6⤵
- Creates scheduled task(s)
PID:4568

C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
"C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"
2⤵
PID:5024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "
3⤵
PID:4792

C:\Windows\SysWOW64\sc.exe
Sc delete GameServerClient
4⤵
- Launches sc.exe
PID:6448

C:\Program Files (x86)\GameServerClient\GameService.exe
GameService remove GameServerClient confirm
4⤵
PID:6708

C:\Program Files (x86)\GameServerClient\GameService.exe
GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
4⤵
PID:3576

C:\Program Files (x86)\GameServerClient\GameService.exe
GameService start GameServerClient
4⤵
PID:7076

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
3⤵
PID:3484

C:\Windows\SysWOW64\sc.exe
Sc delete GameServerClientC
4⤵
- Launches sc.exe
PID:5596

C:\Program Files (x86)\GameServerClient\GameService.exe
GameService remove GameServerClientC confirm
4⤵
PID:6752

C:\Program Files (x86)\GameServerClient\GameService.exe
GameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
4⤵
PID:684

C:\Program Files (x86)\GameServerClient\GameService.exe
GameService start GameServerClientC
4⤵
PID:1760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
3⤵
PID:6532

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
2⤵
PID:5400

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5312 -ip 5312
1⤵
PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5440 -ip 5440
1⤵
PID:5884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6080 -ip 6080
1⤵
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=748 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:5196

C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
1⤵
PID:6884

C:\Program Files (x86)\GameServerClient\GameServerClient.exe
"C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
2⤵
PID:6660

C:\Windows\Temp\698902.exe
"C:\Windows\Temp\698902.exe" --list-devices
3⤵
PID:6500

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6608 -ip 6608
1⤵
PID:832

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 7044 -ip 7044
1⤵
PID:5940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4064

C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
1⤵
PID:6028

C:\Program Files (x86)\GameServerClient\GameServerClientC.exe
"C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
2⤵
PID:3456

C:\Windows\Temp\977504.exe
"C:\Windows\Temp\977504.exe" --coin BTC -m ADDRESSES -t 0 --range 341f25d3c80000000:341f25d3cc0000000 -o xxx0.txt -i C:\Windows\Temp\curjob.bin
3⤵
PID:5592

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery