amadey | 2e51701c2ae78af7f1ff4d2aed64148e19d138c36c4096cae67c638e642e054e

Processes:

sysmablsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

axplong.exehttp77.91.77.80mineamadka.exe.exehttp77.91.77.82mineamadka.exe.exehttp77.91.77.81mineamadka.exe.exeexplortu.exeexplortu.exe240c215464.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	http77.91.77.80mineamadka.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	http77.91.77.82mineamadka.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	http77.91.77.81mineamadka.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	240c215464.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

5584 powershell.exe
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
5584	powershell.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

axplong.exe240c215464.exehttp77.91.77.80mineamadka.exe.exehttp77.91.77.82mineamadka.exe.exeexplortu.exeexplortu.exehttp77.91.77.81mineamadka.exe.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	240c215464.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	http77.91.77.80mineamadka.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	http77.91.77.82mineamadka.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	240c215464.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	http77.91.77.80mineamadka.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	http77.91.77.81mineamadka.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	http77.91.77.82mineamadka.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	http77.91.77.81mineamadka.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe

Executes dropped EXE 20 IoCs

Processes:

http185.215.113.66pei.exe.exehttptwizt.netnewtpp.exe.exehttp185.172.128.127tiktok.exe.exehttpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exesysmablsvr.exehttpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exehttpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exehttp77.91.77.80mineamadka.exe.exehttp77.91.77.82mineamadka.exe.exehttp77.91.77.81mineamadka.exe.exe1194320431.exeexplortu.exeexplortu.exe240c215464.exefe283482d2.exe2725515623.exeaxplong.exe59a18813cd.exehttp77.91.77.82lendinstaller2.exe.exehttp106.166.173.36imgtest.exe.exe

pid	process
1412	http185.215.113.66pei.exe.exe
4916	httptwizt.netnewtpp.exe.exe
3400	http185.172.128.127tiktok.exe.exe
4652	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1920	sysmablsvr.exe
408	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1708	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
2104	http77.91.77.80mineamadka.exe.exe
2448	http77.91.77.82mineamadka.exe.exe
4264	http77.91.77.81mineamadka.exe.exe
4952	1194320431.exe
3068	explortu.exe
3752	explortu.exe
4000	240c215464.exe
2444	fe283482d2.exe
1704	2725515623.exe
2264	axplong.exe
1756	59a18813cd.exe
4692	http77.91.77.82lendinstaller2.exe.exe
5208	http106.166.173.36imgtest.exe.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

axplong.exehttp77.91.77.80mineamadka.exe.exehttp77.91.77.82mineamadka.exe.exehttp77.91.77.81mineamadka.exe.exeexplortu.exeexplortu.exe240c215464.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	http77.91.77.80mineamadka.exe.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	http77.91.77.82mineamadka.exe.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	http77.91.77.81mineamadka.exe.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	240c215464.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/6260-1181-0x0000000000C80000-0x00000000015E4000-memory.dmp	themida
behavioral1/memory/6260-1180-0x0000000000C80000-0x00000000015E4000-memory.dmp	themida

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/5208-411-0x0000000000930000-0x0000000001954000-memory.dmp	upx
behavioral1/memory/5208-419-0x0000000000930000-0x0000000001954000-memory.dmp	upx
behavioral1/memory/5604-420-0x0000000000930000-0x0000000001954000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

sysmablsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

explortu.exefe283482d2.exehttptwizt.netnewtpp.exe.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\fe283482d2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\fe283482d2.exe"	explortu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	fe283482d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	httptwizt.netnewtpp.exe.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

57 ipinfo.io
59 ipinfo.io

flow	ioc
57	ipinfo.io
59	ipinfo.io

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000017001\59a18813cd.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\spanWTyEaQ9pYU8Z\_Qb4aWoM8ThWVxITui_a.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

Processes:

http77.91.77.80mineamadka.exe.exehttp77.91.77.82mineamadka.exe.exehttp77.91.77.81mineamadka.exe.exeexplortu.exeexplortu.exe240c215464.exeaxplong.exefe283482d2.exehttp77.91.77.82lendinstaller2.exe.exe

pid	process
2104	http77.91.77.80mineamadka.exe.exe
2448	http77.91.77.82mineamadka.exe.exe
4264	http77.91.77.81mineamadka.exe.exe
3068	explortu.exe
3752	explortu.exe
4000	240c215464.exe
2264	axplong.exe
2444	fe283482d2.exe
4692	http77.91.77.82lendinstaller2.exe.exe
4692	http77.91.77.82lendinstaller2.exe.exe

Drops file in Windows directory 5 IoCs

Processes:

httptwizt.netnewtpp.exe.exehttp77.91.77.80mineamadka.exe.exehttp77.91.77.81mineamadka.exe.exe240c215464.exe

description	ioc	process
File created	C:\Windows\sysmablsvr.exe	httptwizt.netnewtpp.exe.exe
File opened for modification	C:\Windows\sysmablsvr.exe	httptwizt.netnewtpp.exe.exe
File created	C:\Windows\Tasks\explortu.job	http77.91.77.80mineamadka.exe.exe
File created	C:\Windows\Tasks\explortu.job	http77.91.77.81mineamadka.exe.exe
File created	C:\Windows\Tasks\axplong.job	240c215464.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

7344 sc.exe
6044 sc.exe
4452 sc.exe
3012 sc.exe
3524 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5284 6024 WerFault.exe http77.91.77.81lendvictor.exe.exe
6504 6272 WerFault.exe http77.91.77.82lendvictor.exe.exe

pid	process
7344	sc.exe
6044	sc.exe
4452	sc.exe
3012	sc.exe
3524	sc.exe

pid	pid_target	process	target process
5284	6024	WerFault.exe	http77.91.77.81lendvictor.exe.exe
6504	6272	WerFault.exe	http77.91.77.82lendvictor.exe.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend228.exe.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend228.exe.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe

Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4724 schtasks.exe
6760 schtasks.exe
2300 schtasks.exe
860 schtasks.exe
6332 schtasks.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

5892 tasklist.exe

pid	process
4724	schtasks.exe
6760	schtasks.exe
2300	schtasks.exe
860	schtasks.exe
6332	schtasks.exe

pid	process
5892	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

http77.91.77.80mineamadka.exe.exehttpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exehttp77.91.77.82mineamadka.exe.exehttp77.91.77.81mineamadka.exe.exeexplortu.exeexplortu.exe240c215464.exeaxplong.exechrome.exehttp77.91.77.82lendinstaller2.exe.exe

pid	process
2104	http77.91.77.80mineamadka.exe.exe
2104	http77.91.77.80mineamadka.exe.exe
408	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
408	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
2448	http77.91.77.82mineamadka.exe.exe
2448	http77.91.77.82mineamadka.exe.exe
4264	http77.91.77.81mineamadka.exe.exe
4264	http77.91.77.81mineamadka.exe.exe
3068	explortu.exe
3068	explortu.exe
3752	explortu.exe
3752	explortu.exe
4000	240c215464.exe
4000	240c215464.exe
2264	axplong.exe
2264	axplong.exe
4176	chrome.exe
4176	chrome.exe
4692	http77.91.77.82lendinstaller2.exe.exe
4692	http77.91.77.82lendinstaller2.exe.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

4176 chrome.exe
4176 chrome.exe
4176 chrome.exe
4176 chrome.exe

pid	process
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Setup.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	516	Setup.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	4176	chrome.exe
Token: SeCreatePagefilePrivilege	4176	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe59a18813cd.exechrome.exe

pid	process
1708	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1708	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1708	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1756	59a18813cd.exe
1756	59a18813cd.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
1756	59a18813cd.exe
4176	chrome.exe
1756	59a18813cd.exe
1756	59a18813cd.exe
4176	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe59a18813cd.exechrome.exe

pid	process
1708	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1708	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1708	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1756	59a18813cd.exe
1756	59a18813cd.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
1756	59a18813cd.exe
1756	59a18813cd.exe
1756	59a18813cd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fe283482d2.exe

pid process

2444 fe283482d2.exe

pid	process
2444	fe283482d2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup.exehttptwizt.netnewtpp.exe.exehttpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exehttp185.215.113.66pei.exe.exehttp77.91.77.80mineamadka.exe.exehttp77.91.77.81mineamadka.exe.exeexplortu.exesysmablsvr.exe240c215464.exe59a18813cd.exechrome.exe

description	pid	process	target process
PID 516 wrote to memory of 1412	516	Setup.exe	http185.215.113.66pei.exe.exe
PID 516 wrote to memory of 1412	516	Setup.exe	http185.215.113.66pei.exe.exe
PID 516 wrote to memory of 1412	516	Setup.exe	http185.215.113.66pei.exe.exe
PID 516 wrote to memory of 4916	516	Setup.exe	httptwizt.netnewtpp.exe.exe
PID 516 wrote to memory of 4916	516	Setup.exe	httptwizt.netnewtpp.exe.exe
PID 516 wrote to memory of 4916	516	Setup.exe	httptwizt.netnewtpp.exe.exe
PID 516 wrote to memory of 3400	516	Setup.exe	http185.172.128.127tiktok.exe.exe
PID 516 wrote to memory of 3400	516	Setup.exe	http185.172.128.127tiktok.exe.exe
PID 516 wrote to memory of 3400	516	Setup.exe	http185.172.128.127tiktok.exe.exe
PID 516 wrote to memory of 4652	516	Setup.exe	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
PID 516 wrote to memory of 4652	516	Setup.exe	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
PID 516 wrote to memory of 4652	516	Setup.exe	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
PID 4916 wrote to memory of 1920	4916	httptwizt.netnewtpp.exe.exe	sysmablsvr.exe
PID 4916 wrote to memory of 1920	4916	httptwizt.netnewtpp.exe.exe	sysmablsvr.exe
PID 4916 wrote to memory of 1920	4916	httptwizt.netnewtpp.exe.exe	sysmablsvr.exe
PID 4652 wrote to memory of 408	4652	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
PID 4652 wrote to memory of 408	4652	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
PID 4652 wrote to memory of 408	4652	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
PID 4652 wrote to memory of 1708	4652	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
PID 4652 wrote to memory of 1708	4652	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
PID 4652 wrote to memory of 1708	4652	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
PID 516 wrote to memory of 2104	516	Setup.exe	http77.91.77.80mineamadka.exe.exe
PID 516 wrote to memory of 2104	516	Setup.exe	http77.91.77.80mineamadka.exe.exe
PID 516 wrote to memory of 2104	516	Setup.exe	http77.91.77.80mineamadka.exe.exe
PID 516 wrote to memory of 2448	516	Setup.exe	http77.91.77.82mineamadka.exe.exe
PID 516 wrote to memory of 2448	516	Setup.exe	http77.91.77.82mineamadka.exe.exe
PID 516 wrote to memory of 2448	516	Setup.exe	http77.91.77.82mineamadka.exe.exe
PID 516 wrote to memory of 4264	516	Setup.exe	http77.91.77.81mineamadka.exe.exe
PID 516 wrote to memory of 4264	516	Setup.exe	http77.91.77.81mineamadka.exe.exe
PID 516 wrote to memory of 4264	516	Setup.exe	http77.91.77.81mineamadka.exe.exe
PID 1412 wrote to memory of 4952	1412	http185.215.113.66pei.exe.exe	1194320431.exe
PID 1412 wrote to memory of 4952	1412	http185.215.113.66pei.exe.exe	1194320431.exe
PID 1412 wrote to memory of 4952	1412	http185.215.113.66pei.exe.exe	1194320431.exe
PID 2104 wrote to memory of 3068	2104	http77.91.77.80mineamadka.exe.exe	explortu.exe
PID 2104 wrote to memory of 3068	2104	http77.91.77.80mineamadka.exe.exe	explortu.exe
PID 2104 wrote to memory of 3068	2104	http77.91.77.80mineamadka.exe.exe	explortu.exe
PID 4264 wrote to memory of 3752	4264	http77.91.77.81mineamadka.exe.exe	explortu.exe
PID 4264 wrote to memory of 3752	4264	http77.91.77.81mineamadka.exe.exe	explortu.exe
PID 4264 wrote to memory of 3752	4264	http77.91.77.81mineamadka.exe.exe	explortu.exe
PID 3068 wrote to memory of 824	3068	explortu.exe	explortu.exe
PID 3068 wrote to memory of 824	3068	explortu.exe	explortu.exe
PID 3068 wrote to memory of 824	3068	explortu.exe	explortu.exe
PID 3068 wrote to memory of 4000	3068	explortu.exe	240c215464.exe
PID 3068 wrote to memory of 4000	3068	explortu.exe	240c215464.exe
PID 3068 wrote to memory of 4000	3068	explortu.exe	240c215464.exe
PID 3068 wrote to memory of 2444	3068	explortu.exe	fe283482d2.exe
PID 3068 wrote to memory of 2444	3068	explortu.exe	fe283482d2.exe
PID 3068 wrote to memory of 2444	3068	explortu.exe	fe283482d2.exe
PID 1920 wrote to memory of 1704	1920	sysmablsvr.exe	2725515623.exe
PID 1920 wrote to memory of 1704	1920	sysmablsvr.exe	2725515623.exe
PID 1920 wrote to memory of 1704	1920	sysmablsvr.exe	2725515623.exe
PID 4000 wrote to memory of 2264	4000	240c215464.exe	axplong.exe
PID 4000 wrote to memory of 2264	4000	240c215464.exe	axplong.exe
PID 4000 wrote to memory of 2264	4000	240c215464.exe	axplong.exe
PID 3068 wrote to memory of 1756	3068	explortu.exe	59a18813cd.exe
PID 3068 wrote to memory of 1756	3068	explortu.exe	59a18813cd.exe
PID 3068 wrote to memory of 1756	3068	explortu.exe	59a18813cd.exe
PID 1756 wrote to memory of 4176	1756	59a18813cd.exe	chrome.exe
PID 1756 wrote to memory of 4176	1756	59a18813cd.exe	chrome.exe
PID 4176 wrote to memory of 1320	4176	chrome.exe	chrome.exe
PID 4176 wrote to memory of 1320	4176	chrome.exe	chrome.exe
PID 4176 wrote to memory of 4580	4176	chrome.exe	chrome.exe
PID 4176 wrote to memory of 4580	4176	chrome.exe	chrome.exe
PID 4176 wrote to memory of 4580	4176	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:516
- C:\Users\Admin\AppData\Local\Temp\http185.215.113.66pei.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http185.215.113.66pei.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Users\Admin\AppData\Local\Temp\1194320431.exe
    C:\Users\Admin\AppData\Local\Temp\1194320431.exe
    3⤵
    - Executes dropped EXE
    PID:4952
- C:\Users\Admin\AppData\Local\Temp\httptwizt.netnewtpp.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httptwizt.netnewtpp.exe.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\sysmablsvr.exe
    C:\Windows\sysmablsvr.exe
    3⤵
    - Modifies security service
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\2725515623.exe
      C:\Users\Admin\AppData\Local\Temp\2725515623.exe
      4⤵
      Executes dropped EXE
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\1417122195.exe
      C:\Users\Admin\AppData\Local\Temp\1417122195.exe
      4⤵
      PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\1279516267.exe
      C:\Users\Admin\AppData\Local\Temp\1279516267.exe
      4⤵
      PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\341011103.exe
      C:\Users\Admin\AppData\Local\Temp\341011103.exe
      4⤵
      PID:5276
    - - C:\Windows\winblrsnrcs.exe
        
        C:\Windows\winblrsnrcs.exe
        5⤵
        
        PID:6788
- C:\Users\Admin\AppData\Local\Temp\http185.172.128.127tiktok.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http185.172.128.127tiktok.exe.exe"
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe" --local-service
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:408
- - C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe" --local-control
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1708
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.80mineamadka.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.80mineamadka.exe.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
      4⤵
      PID:824
  - - C:\Users\Admin\1000015002\240c215464.exe
      "C:\Users\Admin\1000015002\240c215464.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\onefile_7148_133628593871065585\stub.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
        7⤵
        
        PID:5732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        8⤵
        
        PID:7004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        8⤵
        
        PID:6996
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        9⤵
        
        PID:5248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        8⤵
        
        PID:6932
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe"
        6⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
        6⤵
        
        PID:6456
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:6532
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
        6⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
        6⤵
        
        PID:7012
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe"
        6⤵
        
        PID:1756
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:7172
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\1000064001\NewKindR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000064001\NewKindR.exe"
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\1000060001\onecommander.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000060001\onecommander.exe"
        6⤵
        
        PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\1000016001\fe283482d2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000016001\fe283482d2.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      PID:2444
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:2300
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:860
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496 HR" /sc HOURLY /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:6332
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\spanWTyEaQ9pYU8Z\_Qb4aWoM8ThWVxITui_a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spanWTyEaQ9pYU8Z\_Qb4aWoM8ThWVxITui_a.exe"
        5⤵
        
        PID:7032
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_f09ac2d587354c6431bf93812ba7548f\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_f09ac2d587354c6431bf93812ba7548f HR" /sc HOURLY /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\1000017001\59a18813cd.exe
      "C:\Users\Admin\AppData\Local\Temp\1000017001\59a18813cd.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4176
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffff7109758,0x7ffff7109768,0x7ffff7109778
        6⤵
        
        PID:1320
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:2
        6⤵
        
        PID:4580
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1636 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:8
        6⤵
        
        PID:1536
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:8
        6⤵
        
        PID:4620
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:1
        6⤵
        
        PID:4252
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:1
        6⤵
        
        PID:3308
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4388 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:1
        6⤵
        
        PID:4408
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3620 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:1
        6⤵
        
        PID:5264
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4392 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:8
        6⤵
        
        PID:5384
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:8
        6⤵
        
        PID:5392
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5048 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:8
        6⤵
        
        PID:5504
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:8
        6⤵
        
        PID:6060
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 --field-trial-handle=1736,i,9673834946970016935,6211676255505722621,131072 /prefetch:8
        6⤵
        
        PID:6900
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82mineamadka.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82mineamadka.exe.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81mineamadka.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81mineamadka.exe.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3752
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendinstaller2.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendinstaller2.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6780
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4464
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:6044
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4452
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3012
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:3524
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:7344
- C:\Users\Admin\AppData\Local\Temp\http106.166.173.36imgtest.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http106.166.173.36imgtest.exe.exe"
  2⤵
  - Executes dropped EXE
  PID:5208
- - C:\Users\Admin\AppData\Local\Temp\http106.166.173.36imgtest.exe.exe
    C:\Users\Admin\AppData\Local\Temp\http106.166.173.36imgtest.exe.exe
    3⤵
    PID:5604
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      PID:6180
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendalex.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendalex.exe.exe"
  2⤵
  PID:5420
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5740
  - - C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
      4⤵
      PID:6092
  - - C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
      4⤵
      PID:6100
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfile.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfile.exe.exe"
  2⤵
  PID:5876
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendnn.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendnn.exe.exe"
  2⤵
  PID:5168
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendnn.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendnn.exe.exe"
    3⤵
    PID:6124
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendw.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendw.exe.exe"
  2⤵
  PID:5968
- - C:\Users\Admin\AppData\Local\Temp\s.exe
    "C:\Users\Admin\AppData\Local\Temp\s.exe"
    3⤵
    PID:6260
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendvictor.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendvictor.exe.exe"
  2⤵
  PID:6024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 272
    3⤵
    - Program crash
    PID:5284
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lend228.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lend228.exe.exe"
  2⤵
  PID:5236
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Descriptions Descriptions.cmd & Descriptions.cmd & exit
    3⤵
    PID:6596
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfile.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfile.exe.exe"
  2⤵
  PID:6236
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendlook.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendlook.exe.exe"
  2⤵
  PID:6360
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendlook.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendlook.exe.exe"
    3⤵
    PID:6452
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendlook.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendlook.exe.exe"
  2⤵
  PID:6380
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendlook.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendlook.exe.exe"
    3⤵
    PID:6512
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendw.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendw.exe.exe"
  2⤵
  PID:6724
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendswizzy.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendswizzy.exe.exe"
  2⤵
  PID:6784
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1204
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfileosn.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfileosn.exe.exe"
  2⤵
  PID:6832
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:7156
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5216
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendinstaller2.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendinstaller2.exe.exe"
  2⤵
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfileosn.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfileosn.exe.exe"
  2⤵
  PID:6400
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:7112
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend228.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend228.exe.exe"
  2⤵
  PID:5888
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendalex.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendalex.exe.exe"
  2⤵
  PID:5884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5224
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5812
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lend1234.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lend1234.exe.exe"
  2⤵
  PID:6980
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe"
  2⤵
  PID:6952
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendnn.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendnn.exe.exe"
  2⤵
  PID:7016
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendnn.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendnn.exe.exe"
    3⤵
    PID:6280
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendvictor.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendvictor.exe.exe"
  2⤵
  PID:6272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 272
    3⤵
    - Program crash
    PID:6504
- C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfud.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfud.exe.exe"
  2⤵
  PID:7124
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfud.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfud.exe.exe"
    3⤵
    PID:6864

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:760

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:5436

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
PID:5556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion