amadey | 2e51701c2ae78af7f1ff4d2aed64148e19d138c36c4096cae67c638e642e054e

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	winblrsnrcs.exe

Phorphiex payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000900000001aacd-11.dat	family_phorphiex
behavioral1/files/0x000800000001abef-216.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/memory/5580-419-0x0000000000850000-0x00000000008A2000-memory.dmp	family_redline
behavioral1/memory/1256-1185-0x0000000000620000-0x0000000000670000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 6100 created 3380	6100	1453930929.exe	55
PID 6100 created 3380	6100	1453930929.exe	55

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winblrsnrcs.exe

Xehook stealer
Xehook is an infostealer written in C#.
stealer xehook
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	http77.91.77.82mineamadka.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	http77.91.77.80mineamadka.exe.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
7204	powershell.exe
6752	powershell.exe
6676	powershell.exe
5756	powershell.exe
1000	powershell.exe
5112	powershell.exe
7668	powershell.exe
6072	powershell.exe
6560	powershell.exe
2284	powershell.exe
8028	powershell.exe
5800	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	http77.91.77.80mineamadka.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	http77.91.77.80mineamadka.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	http77.91.77.82mineamadka.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	http77.91.77.82mineamadka.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk	c05a20d254.exe

Executes dropped EXE 64 IoCs

pid	Process
1304	http185.215.113.66pei.exe.exe
1504	httptwizt.netnewtpp.exe.exe
2124	sysmablsvr.exe
3908	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1736	http185.172.128.127tiktok.exe.exe
2632	143303174.exe
4784	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
4176	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1712	http77.91.77.80mineamadka.exe.exe
4808	explortu.exe
5052	explortu.exe
1452	http77.91.77.82mineamadka.exe.exe
2272	406625063.exe
2952	c05a20d254.exe
1056	4e6762088f.exe
5240	952927809.exe
5272	http77.91.77.82lendalex.exe.exe
5580	svhoost.exe
5596	One.exe
5984	http77.91.77.82lendw.exe.exe
6056	s.exe
6100	1453930929.exe
6128	http77.91.77.82lend228.exe.exe
5136	2026229022.exe
5420	http77.91.77.81lendvictor.exe.exe
5792	http77.91.77.81lendfile.exe.exe
8	http77.91.77.81lend228.exe.exe
5228	http77.91.77.82lendlook.exe.exe
5272	http77.91.77.82lendlook.exe.exe
5256	http77.91.77.81lendlook.exe.exe
5612	http77.91.77.81lendlook.exe.exe
6024	http77.91.77.81lendw.exe.exe
5264	3235322023.exe
5252	s.exe
6044	winblrsnrcs.exe
5284	http106.166.173.36imgtest.exe.exe
2468	http77.91.77.81lendswizzy.exe.exe
3292	http106.166.173.36imgtest.exe.exe
5204	http77.91.77.82lendfileosn.exe.exe
6064	http77.91.77.82lendinstaller2.exe.exe
6408	http77.91.77.82lendfile.exe.exe
6432	http77.91.77.82lendnn.exe.exe
6508	http77.91.77.82lendnn.exe.exe
6676	http77.91.77.81lendfileosn.exe.exe
6660	http77.91.77.81lendinstaller2.exe.exe
6292	http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe
4708	http77.91.77.81lendfud.exe.exe
6308	http77.91.77.82lend1234.exe.exe
5284	http77.91.77.81lendalex.exe.exe
5836	http77.91.77.81lendnn.exe.exe
6488	http77.91.77.81lendfud.exe.exe
5576	http77.91.77.82lendvictor.exe.exe
6708	http77.91.77.81lendnn.exe.exe
5704	http77.91.77.81lend37.exe.exe
3840	http77.91.77.81lend27.exe.exe
6220	1338716755.exe
5488	http77.91.77.82lendii.exe.exe
2744	http77.91.77.82lendfud.exe.exe
6444	http77.91.77.82lendii.exe.exe
5864	http77.91.77.82lendfud.exe.exe
6844	One.exe
7080	svhoost.exe
6112	http77.91.77.81lendcleaner.exe.exe
764	http77.91.77.82lendcleaner.exe.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	http77.91.77.82mineamadka.exe.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	http77.91.77.80mineamadka.exe.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	explortu.exe

Loads dropped DLL 1 IoCs

pid	Process
6308	http77.91.77.82lend1234.exe.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/6056-604-0x0000000000190000-0x0000000000AF4000-memory.dmp	themida
behavioral1/memory/6056-607-0x0000000000190000-0x0000000000AF4000-memory.dmp	themida
behavioral1/memory/5252-852-0x0000000000190000-0x0000000000AF4000-memory.dmp	themida
behavioral1/memory/5252-853-0x0000000000190000-0x0000000000AF4000-memory.dmp	themida
behavioral1/memory/5252-951-0x0000000000190000-0x0000000000AF4000-memory.dmp	themida

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5284-663-0x0000000000C70000-0x0000000001C94000-memory.dmp	upx
behavioral1/memory/3292-675-0x0000000000C70000-0x0000000001C94000-memory.dmp	upx
behavioral1/memory/5284-674-0x0000000000C70000-0x0000000001C94000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winblrsnrcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c05a20d254.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c05a20d254.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c05a20d254.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	c05a20d254.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV131_30f85fd004d4df68ea1f8d35c18db496 = "C:\\Users\\Admin\\AppData\\Local\\AdobeUpdaterV131_30f85fd004d4df68ea1f8d35c18db496\\AdobeUpdaterV131.exe"	c05a20d254.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV131_f09ac2d587354c6431bf93812ba7548f = "C:\\Users\\Admin\\AppData\\Local\\AdobeUpdaterV131_f09ac2d587354c6431bf93812ba7548f\\AdobeUpdaterV131.exe"	c05a20d254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	httptwizt.netnewtpp.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\c05a20d254.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\c05a20d254.exe"	explortu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winblrsnrcs.exe"	3235322023.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	s.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	s.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
255	bitbucket.org
287	pastebin.com
542	pastebin.com
543	pastebin.com
573	pastebin.com
176	bitbucket.org
179	bitbucket.org
254	bitbucket.org
258	pastebin.com
261	pastebin.com

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
327	ipinfo.io
109	ipinfo.io
114	ipinfo.io
194	ip-api.com
251	ip-api.com
323	api.myip.com
325	api.myip.com
326	ipinfo.io

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	http77.91.77.82lend1234.exe.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000800000001ac1b-342.dat	autoit_exe
behavioral1/files/0x000700000001ace9-1044.dat	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	http77.91.77.82lendinstaller2.exe.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
1712	http77.91.77.80mineamadka.exe.exe
4808	explortu.exe
5052	explortu.exe
1452	http77.91.77.82mineamadka.exe.exe
2952	c05a20d254.exe
2952	c05a20d254.exe
6056	s.exe
2952	c05a20d254.exe
5252	s.exe
6064	http77.91.77.82lendinstaller2.exe.exe
2952	c05a20d254.exe
6064	http77.91.77.82lendinstaller2.exe.exe
6660	http77.91.77.81lendinstaller2.exe.exe
6660	http77.91.77.81lendinstaller2.exe.exe
2952	c05a20d254.exe
2952	c05a20d254.exe
5476	explortu.exe
2952	c05a20d254.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 5272 set thread context of 5412	5272	http77.91.77.82lendalex.exe.exe	109
PID 5228 set thread context of 5272	5228	http77.91.77.82lendlook.exe.exe	130
PID 5256 set thread context of 5612	5256	http77.91.77.81lendlook.exe.exe	134
PID 2468 set thread context of 6024	2468	http77.91.77.81lendswizzy.exe.exe	147
PID 5204 set thread context of 6336	5204	http77.91.77.82lendfileosn.exe.exe	152
PID 6432 set thread context of 6508	6432	http77.91.77.82lendnn.exe.exe	270
PID 6676 set thread context of 7020	6676	http77.91.77.81lendfileosn.exe.exe	162
PID 4708 set thread context of 6488	4708	http77.91.77.81lendfud.exe.exe	168
PID 5836 set thread context of 6708	5836	http77.91.77.81lendnn.exe.exe	170
PID 5284 set thread context of 6828	5284	http77.91.77.81lendalex.exe.exe	171
PID 5488 set thread context of 6444	5488	http77.91.77.82lendii.exe.exe	195
PID 2744 set thread context of 5864	2744	http77.91.77.82lendfud.exe.exe	181
PID 6384 set thread context of 5132	6384	http77.91.77.82lendswizzy.exe.exe	204
PID 5436 set thread context of 6208	5436	http77.91.77.81lendii.exe.exe	207
PID 5792 set thread context of 5888	5792	http77.91.77.81lendfile.exe.exe	209

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\sysmablsvr.exe	httptwizt.netnewtpp.exe.exe
File opened for modification	C:\Windows\sysmablsvr.exe	httptwizt.netnewtpp.exe.exe
File created	C:\Windows\Tasks\explortu.job	http77.91.77.80mineamadka.exe.exe
File created	C:\Windows\winblrsnrcs.exe	3235322023.exe
File opened for modification	C:\Windows\winblrsnrcs.exe	3235322023.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5868	sc.exe
4508	sc.exe
6224	sc.exe
5916	sc.exe
7012	sc.exe
6988	sc.exe
1948	sc.exe
5000	sc.exe
6740	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5728	5420	WerFault.exe	120
6836	5576	WerFault.exe	169

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000700000001ac8a-529.dat	nsis_installer_1
behavioral1/files/0x000700000001ac8a-529.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c05a20d254.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c05a20d254.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4772	schtasks.exe
3128	schtasks.exe
6524	schtasks.exe
6508	schtasks.exe
2080	schtasks.exe
2988	schtasks.exe
5876	schtasks.exe
6548	schtasks.exe
4608	schtasks.exe
4080	schtasks.exe
6448	schtasks.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
7484	tasklist.exe
5596	tasklist.exe
1256	tasklist.exe
1056	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133628595149355083"	chrome.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	svhoost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	svhoost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4784	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
4784	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1712	http77.91.77.80mineamadka.exe.exe
1712	http77.91.77.80mineamadka.exe.exe
4808	explortu.exe
4808	explortu.exe
5052	explortu.exe
5052	explortu.exe
1452	http77.91.77.82mineamadka.exe.exe
1452	http77.91.77.82mineamadka.exe.exe
3188	chrome.exe
3188	chrome.exe
6100	1453930929.exe
6100	1453930929.exe
5336	powershell.exe
5336	powershell.exe
5336	powershell.exe
5336	powershell.exe
5284	http106.166.173.36imgtest.exe.exe
3292	http106.166.173.36imgtest.exe.exe
5204	http77.91.77.82lendfileosn.exe.exe
5204	http77.91.77.82lendfileosn.exe.exe
5204	http77.91.77.82lendfileosn.exe.exe
5204	http77.91.77.82lendfileosn.exe.exe
6064	http77.91.77.82lendinstaller2.exe.exe
6064	http77.91.77.82lendinstaller2.exe.exe
6064	http77.91.77.82lendinstaller2.exe.exe
6660	http77.91.77.81lendinstaller2.exe.exe
6660	http77.91.77.81lendinstaller2.exe.exe
2952	c05a20d254.exe
2952	c05a20d254.exe
6560	powershell.exe
6560	powershell.exe
6560	powershell.exe
6100	1453930929.exe
6100	1453930929.exe
6560	powershell.exe
6292	http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe
6292	http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe
6292	http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe
5476	explortu.exe
5476	explortu.exe
5704	http77.91.77.81lend37.exe.exe
5704	http77.91.77.81lend37.exe.exe
5704	http77.91.77.81lend37.exe.exe
5704	http77.91.77.81lend37.exe.exe
5704	http77.91.77.81lend37.exe.exe
5704	http77.91.77.81lend37.exe.exe
3840	http77.91.77.81lend27.exe.exe
3840	http77.91.77.81lend27.exe.exe
3840	http77.91.77.81lend27.exe.exe
3840	http77.91.77.81lend27.exe.exe
5704	http77.91.77.81lend37.exe.exe
3840	http77.91.77.81lend27.exe.exe
5704	http77.91.77.81lend37.exe.exe
3840	http77.91.77.81lend27.exe.exe
5704	http77.91.77.81lend37.exe.exe
5704	http77.91.77.81lend37.exe.exe
5704	http77.91.77.81lend37.exe.exe
5704	http77.91.77.81lend37.exe.exe
5704	http77.91.77.81lend37.exe.exe
5704	http77.91.77.81lend37.exe.exe
3840	http77.91.77.81lend27.exe.exe
3840	http77.91.77.81lend27.exe.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	Setup.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeDebugPrivilege	5596	One.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeDebugPrivilege	5336	powershell.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeDebugPrivilege	5272	http77.91.77.82lendlook.exe.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeDebugPrivilege	5612	http77.91.77.81lendlook.exe.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeIncreaseQuotaPrivilege	5336	powershell.exe
Token: SeSecurityPrivilege	5336	powershell.exe
Token: SeTakeOwnershipPrivilege	5336	powershell.exe
Token: SeLoadDriverPrivilege	5336	powershell.exe
Token: SeSystemProfilePrivilege	5336	powershell.exe
Token: SeSystemtimePrivilege	5336	powershell.exe
Token: SeProfSingleProcessPrivilege	5336	powershell.exe
Token: SeIncBasePriorityPrivilege	5336	powershell.exe
Token: SeCreatePagefilePrivilege	5336	powershell.exe
Token: SeBackupPrivilege	5336	powershell.exe
Token: SeRestorePrivilege	5336	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4176	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
4176	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
4176	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1712	http77.91.77.80mineamadka.exe.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
3188	chrome.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4176	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
4176	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
4176	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
3188	chrome.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
1056	4e6762088f.exe
6944	iydVgMPpiA_b127o2yze.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2952	c05a20d254.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1304	4616	Setup.exe	74
PID 4616 wrote to memory of 1304	4616	Setup.exe	74
PID 4616 wrote to memory of 1304	4616	Setup.exe	74
PID 4616 wrote to memory of 1504	4616	Setup.exe	75
PID 4616 wrote to memory of 1504	4616	Setup.exe	75
PID 4616 wrote to memory of 1504	4616	Setup.exe	75
PID 1504 wrote to memory of 2124	1504	httptwizt.netnewtpp.exe.exe	76
PID 1504 wrote to memory of 2124	1504	httptwizt.netnewtpp.exe.exe	76
PID 1504 wrote to memory of 2124	1504	httptwizt.netnewtpp.exe.exe	76
PID 4616 wrote to memory of 3908	4616	Setup.exe	77
PID 4616 wrote to memory of 3908	4616	Setup.exe	77
PID 4616 wrote to memory of 3908	4616	Setup.exe	77
PID 4616 wrote to memory of 1736	4616	Setup.exe	78
PID 4616 wrote to memory of 1736	4616	Setup.exe	78
PID 4616 wrote to memory of 1736	4616	Setup.exe	78
PID 1304 wrote to memory of 2632	1304	http185.215.113.66pei.exe.exe	79
PID 1304 wrote to memory of 2632	1304	http185.215.113.66pei.exe.exe	79
PID 1304 wrote to memory of 2632	1304	http185.215.113.66pei.exe.exe	79
PID 3908 wrote to memory of 4784	3908	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	80
PID 3908 wrote to memory of 4784	3908	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	80
PID 3908 wrote to memory of 4784	3908	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	80
PID 3908 wrote to memory of 4176	3908	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	81
PID 3908 wrote to memory of 4176	3908	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	81
PID 3908 wrote to memory of 4176	3908	httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe	81
PID 4616 wrote to memory of 1712	4616	Setup.exe	83
PID 4616 wrote to memory of 1712	4616	Setup.exe	83
PID 4616 wrote to memory of 1712	4616	Setup.exe	83
PID 1712 wrote to memory of 4808	1712	http77.91.77.80mineamadka.exe.exe	84
PID 1712 wrote to memory of 4808	1712	http77.91.77.80mineamadka.exe.exe	84
PID 1712 wrote to memory of 4808	1712	http77.91.77.80mineamadka.exe.exe	84
PID 4616 wrote to memory of 1452	4616	Setup.exe	86
PID 4616 wrote to memory of 1452	4616	Setup.exe	86
PID 4616 wrote to memory of 1452	4616	Setup.exe	86
PID 4808 wrote to memory of 1724	4808	explortu.exe	87
PID 4808 wrote to memory of 1724	4808	explortu.exe	87
PID 4808 wrote to memory of 1724	4808	explortu.exe	87
PID 2124 wrote to memory of 2272	2124	sysmablsvr.exe	88
PID 2124 wrote to memory of 2272	2124	sysmablsvr.exe	88
PID 2124 wrote to memory of 2272	2124	sysmablsvr.exe	88
PID 4808 wrote to memory of 2952	4808	explortu.exe	89
PID 4808 wrote to memory of 2952	4808	explortu.exe	89
PID 4808 wrote to memory of 2952	4808	explortu.exe	89
PID 4808 wrote to memory of 1056	4808	explortu.exe	90
PID 4808 wrote to memory of 1056	4808	explortu.exe	90
PID 4808 wrote to memory of 1056	4808	explortu.exe	90
PID 1056 wrote to memory of 3188	1056	4e6762088f.exe	91
PID 1056 wrote to memory of 3188	1056	4e6762088f.exe	91
PID 3188 wrote to memory of 1032	3188	chrome.exe	93
PID 3188 wrote to memory of 1032	3188	chrome.exe	93
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94
PID 3188 wrote to memory of 1124	3188	chrome.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c05a20d254.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c05a20d254.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3380
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Users\Admin\AppData\Local\Temp\http185.215.113.66pei.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http185.215.113.66pei.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\143303174.exe
      C:\Users\Admin\AppData\Local\Temp\143303174.exe
      4⤵
      Executes dropped EXE
      PID:2632
- - C:\Users\Admin\AppData\Local\Temp\httptwizt.netnewtpp.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\httptwizt.netnewtpp.exe.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\sysmablsvr.exe
      C:\Windows\sysmablsvr.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Suspicious use of WriteProcessMemory
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\406625063.exe
        
        C:\Users\Admin\AppData\Local\Temp\406625063.exe
        5⤵
        Executes dropped EXE
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\952927809.exe
        
        C:\Users\Admin\AppData\Local\Temp\952927809.exe
        5⤵
        Executes dropped EXE
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\1453930929.exe
        
        C:\Users\Admin\AppData\Local\Temp\1453930929.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\2026229022.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026229022.exe
        5⤵
        Executes dropped EXE
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\3235322023.exe
        
        C:\Users\Admin\AppData\Local\Temp\3235322023.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:5264
      - C:\Windows\winblrsnrcs.exe
        
        C:\Windows\winblrsnrcs.exe
        6⤵
        Modifies security service
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\1338716755.exe
        
        C:\Users\Admin\AppData\Local\Temp\1338716755.exe
        7⤵
        Executes dropped EXE
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\1222811284.exe
        
        C:\Users\Admin\AppData\Local\Temp\1222811284.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\1621838176.exe
        
        C:\Users\Admin\AppData\Local\Temp\1621838176.exe
        7⤵
        
        PID:424
        
        C:\Users\Admin\AppData\Local\Temp\1144214468.exe
        
        C:\Users\Admin\AppData\Local\Temp\1144214468.exe
        7⤵
        
        PID:7636
- - C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe" --local-service
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\httpscontrole-bitvavo.comchecknuuBitvavo-scanner.exe.exe" --local-control
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4176
- - C:\Users\Admin\AppData\Local\Temp\http185.172.128.127tiktok.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http185.172.128.127tiktok.exe.exe"
    3⤵
    - Executes dropped EXE
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.80mineamadka.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.80mineamadka.exe.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
        5⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\1000016001\c05a20d254.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000016001\c05a20d254.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        outlook_office_path
        outlook_win_path
        
        PID:2952
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:5876
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:4772
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496 HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:6548
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496 LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\spanvVEDIBgJWzvi\iydVgMPpiA_b127o2yze.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spanvVEDIBgJWzvi\iydVgMPpiA_b127o2yze.exe"
        6⤵
        Suspicious use of SendNotifyMessage
        
        PID:6944
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_f09ac2d587354c6431bf93812ba7548f\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_f09ac2d587354c6431bf93812ba7548f HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:4080
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_f09ac2d587354c6431bf93812ba7548f\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_f09ac2d587354c6431bf93812ba7548f LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\spanvVEDIBgJWzvi\lSgwDkC55WYzEXIFfTF0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spanvVEDIBgJWzvi\lSgwDkC55WYzEXIFfTF0.exe"
        6⤵
        
        PID:4136
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_0e77e820e5c00ed5b0585a4d674a2e51\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_0e77e820e5c00ed5b0585a4d674a2e51 HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:6524
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_0e77e820e5c00ed5b0585a4d674a2e51\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_0e77e820e5c00ed5b0585a4d674a2e51 LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\spanvVEDIBgJWzvi\gA52NWlcCoqkZ_3pKAy9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spanvVEDIBgJWzvi\gA52NWlcCoqkZ_3pKAy9.exe"
        6⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\1000017001\4e6762088f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000017001\4e6762088f.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1056
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff800759758,0x7ff800759768,0x7ff800759778
        7⤵
        
        PID:1032
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:2
        7⤵
        
        PID:1124
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:8
        7⤵
        
        PID:2904
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:8
        7⤵
        
        PID:5052
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:1
        7⤵
        
        PID:4436
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:1
        7⤵
        
        PID:4612
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3852 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:1
        7⤵
        
        PID:2844
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3240 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:1
        7⤵
        
        PID:3500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4432 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:8
        7⤵
        
        PID:4612
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:8
        7⤵
        
        PID:4728
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5212 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:8
        7⤵
        
        PID:5304
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:8
        7⤵
        
        PID:5348
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 --field-trial-handle=1808,i,3044853489216839092,12732157013144933862,131072 /prefetch:8
        7⤵
        
        PID:5452
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82mineamadka.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82mineamadka.exe.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendalex.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendalex.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5272
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        
        PID:5580
    - - C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5596
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendw.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendw.exe.exe"
    3⤵
    - Executes dropped EXE
    PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\s.exe
      "C:\Users\Admin\AppData\Local\Temp\s.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:6056
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lend228.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lend228.exe.exe"
    3⤵
    - Executes dropped EXE
    PID:6128
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Descriptions Descriptions.cmd & Descriptions.cmd & exit
      4⤵
      PID:5684
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7484
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        5⤵
        
        PID:7732
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:1256
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:5060
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendvictor.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendvictor.exe.exe"
    3⤵
    - Executes dropped EXE
    PID:5420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 276
      4⤵
      Program crash
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfile.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfile.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5792
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      PID:5888
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend228.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend228.exe.exe"
    3⤵
    - Executes dropped EXE
    PID:8
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Descriptions Descriptions.cmd & Descriptions.cmd & exit
      4⤵
      PID:6124
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5596
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        5⤵
        
        PID:2344
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:1056
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:5980
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendlook.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendlook.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendlook.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendlook.exe.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5272
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendlook.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendlook.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendlook.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendlook.exe.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendw.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendw.exe.exe"
    3⤵
    - Executes dropped EXE
    PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\s.exe
      "C:\Users\Admin\AppData\Local\Temp\s.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:5252
- - C:\Users\Admin\AppData\Local\Temp\http106.166.173.36imgtest.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http106.166.173.36imgtest.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\http106.166.173.36imgtest.exe.exe
      C:\Users\Admin\AppData\Local\Temp\http106.166.173.36imgtest.exe.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3292
    - - C:\Windows\system32\whoami.exe
        
        whoami
        5⤵
        
        PID:6576
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendswizzy.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendswizzy.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2468
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendinstaller2.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendinstaller2.exe.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:6064
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3880
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:6756
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:1948
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:5000
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:5868
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:4508
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:6740
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:764
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:6964
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:2092
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:2056
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:6112
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:588
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "WindowsAutHost"
      4⤵
      Launches sc.exe
      PID:6224
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto"
      4⤵
      Launches sc.exe
      PID:5916
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:6988
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "WindowsAutHost"
      4⤵
      Launches sc.exe
      PID:7012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6432
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfileosn.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfileosn.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:5204
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:6316
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:6328
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:6336
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfile.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfile.exe.exe"
    3⤵
    - Executes dropped EXE
    PID:6408
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      PID:372
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendnn.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendnn.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendnn.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendnn.exe.exe"
      4⤵
      Executes dropped EXE
      PID:6508
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendinstaller2.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendinstaller2.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:6660
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfileosn.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfileosn.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:6676
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:7020
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:6292
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2284
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DzmQEVPXhX.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1000
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DzmQEVPXhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp565.tmp"
      4⤵
      Creates scheduled task(s)
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe"
      4⤵
      PID:8144
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7204
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'http77.91.77.82lendIerLRtXpEcMnUjz.exe.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8028
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6752
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5800
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "cmd" /tr "C:\ProgramData\cmd.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:2080
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lend1234.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lend1234.exe.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe" /c:WW.Sam.CPI202405 /pmode:2 /promo:eyJib290dGltZSI6IjMiLCJtZWRhbCI6IjMiLCJuZXdzIjoiMCIsIm9wZXJhIjoiMyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjMiLCJyZW1pbmRlciI6IjMiLCJ1cGdyYWRlX25vdyI6IjAifQo=
      4⤵
      PID:7924
    - - C:\Program Files (x86)\1718386031_0\360TS_Setup.exe
        
        "C:\Program Files (x86)\1718386031_0\360TS_Setup.exe" /c:WW.Sam.CPI202405 /pmode:2 /promo:eyJib290dGltZSI6IjMiLCJtZWRhbCI6IjMiLCJuZXdzIjoiMCIsIm9wZXJhIjoiMyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjMiLCJyZW1pbmRlciI6IjMiLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
        5⤵
        
        PID:1560
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfud.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfud.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfud.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendfud.exe.exe"
      4⤵
      Executes dropped EXE
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendalex.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendalex.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5284
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6828
    - - C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
        5⤵
        Executes dropped EXE
        
        PID:6844
    - - C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
        5⤵
        Executes dropped EXE
        
        PID:7080
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendnn.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendnn.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendnn.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendnn.exe.exe"
      4⤵
      Executes dropped EXE
      PID:6708
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendvictor.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendvictor.exe.exe"
    3⤵
    - Executes dropped EXE
    PID:5576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 272
      4⤵
      Program crash
      PID:6836
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend37.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend37.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5704
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend27.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend27.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3840
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendii.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendii.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendii.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendii.exe.exe"
      4⤵
      Executes dropped EXE
      PID:6444
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfud.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfud.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfud.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendfud.exe.exe"
      4⤵
      Executes dropped EXE
      PID:5864
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendcleaner.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendcleaner.exe.exe"
    3⤵
    - Executes dropped EXE
    PID:6112
  - - C:\Users\Admin\AppData\Roaming\ccleanerfile.exe
      "C:\Users\Admin\AppData\Roaming\ccleanerfile.exe"
      4⤵
      PID:1256
  - - C:\Users\Admin\AppData\Roaming\XClient.exe
      "C:\Users\Admin\AppData\Roaming\XClient.exe"
      4⤵
      PID:6168
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendcleaner.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendcleaner.exe.exe"
    3⤵
    - Executes dropped EXE
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend1234.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lend1234.exe.exe"
    3⤵
    PID:6960
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendserver.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendserver.exe.exe"
    3⤵
    PID:6732
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendtime2time.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendtime2time.exe.exe"
    3⤵
    PID:6268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendtime2time.exe.exe" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6676
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      PID:6768
    - - C:\Users\Admin\Pictures\4a6pJNS6iQXMmgVhNs3Vzr8R.exe
        
        "C:\Users\Admin\Pictures\4a6pJNS6iQXMmgVhNs3Vzr8R.exe" /s
        5⤵
        
        PID:3540
    - - C:\Users\Admin\Pictures\HE3F6e6Fp3FZQu3ThjZgDKrN.exe
        
        "C:\Users\Admin\Pictures\HE3F6e6Fp3FZQu3ThjZgDKrN.exe"
        5⤵
        
        PID:5744
    - - C:\Users\Admin\Pictures\1FcFb1lNRlYY00H2GfBP3BNI.exe
        
        "C:\Users\Admin\Pictures\1FcFb1lNRlYY00H2GfBP3BNI.exe"
        5⤵
        
        PID:6256
    - - C:\Users\Admin\Pictures\kSGEyICwvdcUPzkn7Whqvqpb.exe
        
        "C:\Users\Admin\Pictures\kSGEyICwvdcUPzkn7Whqvqpb.exe" /s
        5⤵
        
        PID:6804
      - C:\Users\Admin\Pictures\360TS_Setup.exe
        
        "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
        6⤵
        
        PID:6504
        
        C:\Program Files (x86)\1718386342_0\360TS_Setup.exe
        
        "C:\Program Files (x86)\1718386342_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
        7⤵
        
        PID:7800
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendswizzy.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lendswizzy.exe.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:6384
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5132
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lend27.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.82lend27.exe.exe"
    3⤵
    PID:5880
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendtime2time.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendtime2time.exe.exe"
    3⤵
    PID:4844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendtime2time.exe.exe" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5112
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:4516
    - - C:\Users\Admin\Pictures\8ApcCFSDKNJCAdtUjrMMWtgD.exe
        
        "C:\Users\Admin\Pictures\8ApcCFSDKNJCAdtUjrMMWtgD.exe" /s
        5⤵
        
        PID:7460
    - - C:\Users\Admin\Pictures\ax6nFrZReY4gr2sWZzKLDFcw.exe
        
        "C:\Users\Admin\Pictures\ax6nFrZReY4gr2sWZzKLDFcw.exe"
        5⤵
        
        PID:2548
    - - C:\Users\Admin\Pictures\2gbnEHcPp65H5WS0qEOZVug7.exe
        
        "C:\Users\Admin\Pictures\2gbnEHcPp65H5WS0qEOZVug7.exe"
        5⤵
        
        PID:2060
    - - C:\Users\Admin\Pictures\djzptk7h0MJEWC1JJm1FrTc8.exe
        
        "C:\Users\Admin\Pictures\djzptk7h0MJEWC1JJm1FrTc8.exe" /s
        5⤵
        
        PID:7660
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:596
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendIerLRtXpEcMnUjz.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendIerLRtXpEcMnUjz.exe.exe"
    3⤵
    PID:6924
- - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendii.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendii.exe.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendii.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\http77.91.77.81lendii.exe.exe"
      4⤵
      PID:6208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5336
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
  2⤵
  PID:5824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
  2⤵
  PID:7044
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:2380

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5052

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1380

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5476

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:6444

C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
1⤵
PID:6984

C:\ProgramData\WindowsServices\WindowsAutHost
C:\ProgramData\WindowsServices\WindowsAutHost
1⤵
PID:5648
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2808

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:6584

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:5648

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:2940

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:2100

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:8124

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:7912

C:\ProgramData\cmd.exe
C:\ProgramData\cmd.exe
1⤵
PID:5300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\cmd.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DzmQEVPXhX.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6072
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DzmQEVPXhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7851.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2988

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:3672

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:8080

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:1636

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:2992

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:4368

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:5200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion