amadey | 1d6d471c6035fa5140f61590ccb2d31e559cac8212116734d82da1e0fd56aa94

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d9c6a4fa44.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6916	powershell.exe
5560	powershell.exe
6484	powershell.exe
2608	powershell.exe
4596	powershell.exe
5932	powershell.exe
6512	powershell.exe
6336	powershell.exe
2964	powershell.exe
2972	powershell.exe
1544	powershell.exe
5696	powershell.exe
5776	powershell.exe
2124	powershell.exe
2964	powershell.exe
2608	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d9c6a4fa44.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d9c6a4fa44.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	explortu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	d9c6a4fa44.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	e9378efd62.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	axplong.exe

Executes dropped EXE 11 IoCs

pid	Process
464	explortu.exe
2716	d9c6a4fa44.exe
1632	7cd067aa38.exe
4568	axplong.exe
5104	e9378efd62.exe
5448	redline123123.exe
5456	judit.exe
5748	upd.exe
5956	stub.exe
6068	setup222.exe
1544	gold.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	d9c6a4fa44.exe

Loads dropped DLL 4 IoCs

pid	Process
5956	stub.exe
5956	stub.exe
5956	stub.exe
5956	stub.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7cd067aa38.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\7cd067aa38.exe"	explortu.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
104	pastebin.com
105	pastebin.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000002325e-78.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2388	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
464	explortu.exe
2716	d9c6a4fa44.exe
1632	7cd067aa38.exe
4568	axplong.exe
1632	7cd067aa38.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
File created	C:\Windows\Tasks\axplong.job	d9c6a4fa44.exe

Launches sc.exe 18 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2992	sc.exe
5808	sc.exe
6336	sc.exe
5492	sc.exe
6032	sc.exe
5388	sc.exe
4904	sc.exe
5664	sc.exe
3700	sc.exe
6704	sc.exe
2736	sc.exe
2288	sc.exe
3492	sc.exe
6540	sc.exe
3568	sc.exe
1336	sc.exe
532	sc.exe
5952	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 27 IoCs

pid	pid_target	Process	procid_target
7160	6324	WerFault.exe	154
5732	6324	WerFault.exe	154
6988	6324	WerFault.exe	154
6124	6324	WerFault.exe	154
5304	6324	WerFault.exe	154
5144	6324	WerFault.exe	154
6636	6324	WerFault.exe	154
5264	6324	WerFault.exe	154
6568	6324	WerFault.exe	154
6380	6324	WerFault.exe	154
5848	6324	WerFault.exe	154
3412	5844	WerFault.exe	239
1280	5844	WerFault.exe	239
5160	5844	WerFault.exe	239
872	5844	WerFault.exe	239
956	1944	WerFault.exe	265
548	5844	WerFault.exe	239
5516	5844	WerFault.exe	239
5512	5844	WerFault.exe	239
6972	5844	WerFault.exe	239
5788	5844	WerFault.exe	239
4928	5844	WerFault.exe	239
5716	5844	WerFault.exe	239
5832	5844	WerFault.exe	239
5544	5844	WerFault.exe	239
5500	5844	WerFault.exe	239
1180	5844	WerFault.exe	239

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
5472	tasklist.exe
5556	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
6992	taskkill.exe
5188	taskkill.exe
3852	taskkill.exe
6792	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2388	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
2388	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
464	explortu.exe
464	explortu.exe
2716	d9c6a4fa44.exe
2716	d9c6a4fa44.exe
4568	axplong.exe
4568	axplong.exe
4196	chrome.exe
4196	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2388	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
2716	d9c6a4fa44.exe
5104	e9378efd62.exe
5104	e9378efd62.exe
5104	e9378efd62.exe
5104	e9378efd62.exe
5104	e9378efd62.exe
5104	e9378efd62.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
5104	e9378efd62.exe
5104	e9378efd62.exe
5104	e9378efd62.exe
5104	e9378efd62.exe
5104	e9378efd62.exe
5104	e9378efd62.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1632	7cd067aa38.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 464	2388	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe	91
PID 2388 wrote to memory of 464	2388	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe	91
PID 2388 wrote to memory of 464	2388	022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe	91
PID 464 wrote to memory of 3404	464	explortu.exe	96
PID 464 wrote to memory of 3404	464	explortu.exe	96
PID 464 wrote to memory of 3404	464	explortu.exe	96
PID 464 wrote to memory of 2716	464	explortu.exe	98
PID 464 wrote to memory of 2716	464	explortu.exe	98
PID 464 wrote to memory of 2716	464	explortu.exe	98
PID 464 wrote to memory of 1632	464	explortu.exe	100
PID 464 wrote to memory of 1632	464	explortu.exe	100
PID 464 wrote to memory of 1632	464	explortu.exe	100
PID 2716 wrote to memory of 4568	2716	d9c6a4fa44.exe	101
PID 2716 wrote to memory of 4568	2716	d9c6a4fa44.exe	101
PID 2716 wrote to memory of 4568	2716	d9c6a4fa44.exe	101
PID 464 wrote to memory of 5104	464	explortu.exe	126
PID 464 wrote to memory of 5104	464	explortu.exe	126
PID 464 wrote to memory of 5104	464	explortu.exe	126
PID 5104 wrote to memory of 4196	5104	e9378efd62.exe	106
PID 5104 wrote to memory of 4196	5104	e9378efd62.exe	106
PID 4196 wrote to memory of 4824	4196	chrome.exe	108
PID 4196 wrote to memory of 4824	4196	chrome.exe	108
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 2316	4196	chrome.exe	109
PID 4196 wrote to memory of 4732	4196	chrome.exe	110
PID 4196 wrote to memory of 4732	4196	chrome.exe	110
PID 4196 wrote to memory of 2220	4196	chrome.exe	111
PID 4196 wrote to memory of 2220	4196	chrome.exe	111

C:\Users\Admin\AppData\Local\Temp\022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe
"C:\Users\Admin\AppData\Local\Temp\022c76f26770e2686b68a68ee6ed32d35d336308de995473d70c04f1ac6f83d2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:3404
- - C:\Users\Admin\1000015002\d9c6a4fa44.exe
    "C:\Users\Admin\1000015002\d9c6a4fa44.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
        5⤵
        Executes dropped EXE
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
        5⤵
        Executes dropped EXE
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\onefile_5456_133629795987203848\stub.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:5424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:5784
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:5880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        7⤵
        
        PID:208
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
        5⤵
        Executes dropped EXE
        
        PID:5748
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5104
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:440
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
        7⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
        7⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        8⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe"
        5⤵
        Executes dropped EXE
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\SetupWizard.exe
        
        SetupWizard.exe
        6⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\SetupWizard-5901883d10effcdd\SetupWizard.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SetupWizard-5901883d10effcdd\SetupWizard.exe"
        7⤵
        
        PID:6184
        
        C:\Windows\system32\winsvc.exe
        
        "C:\Windows\system32\winsvc.exe" "C:\Users\Admin\AppData\Local\Temp\SetupWizard-5901883d10effcdd\SetupWizard.exe"
        8⤵
        
        PID:6192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6916
        
        C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"
        10⤵
        Launches sc.exe
        
        PID:5664
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6336
        
        C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failure winsvc reset=0 actions=restart/0/restart/0/restart/0
        10⤵
        Launches sc.exe
        
        PID:3700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "description" "winsvc" "\"Windows System Service is the main system supervision service.\""
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5560
        
        C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" description winsvc "Windows System Service is the main system supervision service."
        10⤵
        Launches sc.exe
        
        PID:6704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "start" "winsvc"
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6484
        
        C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" start winsvc
        10⤵
        Launches sc.exe
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
        5⤵
        Executes dropped EXE
        
        PID:1544
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5128
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe"
        5⤵
        
        PID:5596
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\263c5c4d73\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\263c5c4d73\Hkbsse.exe"
        6⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe"
        7⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 756
        8⤵
        Program crash
        
        PID:7160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 800
        8⤵
        Program crash
        
        PID:5732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 808
        8⤵
        Program crash
        
        PID:6988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 904
        8⤵
        Program crash
        
        PID:6124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 912
        8⤵
        Program crash
        
        PID:5304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 908
        8⤵
        Program crash
        
        PID:5144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 796
        8⤵
        Program crash
        
        PID:6636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 1092
        8⤵
        Program crash
        
        PID:5264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 1196
        8⤵
        Program crash
        
        PID:6568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 1196
        8⤵
        Program crash
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
        8⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 556
        9⤵
        Program crash
        
        PID:3412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 564
        9⤵
        Program crash
        
        PID:1280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 592
        9⤵
        Program crash
        
        PID:5160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 568
        9⤵
        Program crash
        
        PID:872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 788
        9⤵
        Program crash
        
        PID:548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 832
        9⤵
        Program crash
        
        PID:5516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 836
        9⤵
        Program crash
        
        PID:5512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 884
        9⤵
        Program crash
        
        PID:6972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 956
        9⤵
        Program crash
        
        PID:5788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 980
        9⤵
        Program crash
        
        PID:4928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 1148
        9⤵
        Program crash
        
        PID:5716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 1176
        9⤵
        Program crash
        
        PID:5832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 1224
        9⤵
        Program crash
        
        PID:5544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 1436
        9⤵
        Program crash
        
        PID:5500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 1428
        9⤵
        Program crash
        
        PID:1180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 768
        8⤵
        Program crash
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe"
        7⤵
        
        PID:5132
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:956
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        9⤵
        
        PID:4572
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:6032
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        
        PID:1336
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:5388
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        8⤵
        Launches sc.exe
        
        PID:5952
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        8⤵
        Launches sc.exe
        
        PID:532
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        8⤵
        
        PID:4492
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        8⤵
        
        PID:5004
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        8⤵
        
        PID:4264
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        8⤵
        
        PID:2964
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "WSNKISKT"
        8⤵
        Launches sc.exe
        
        PID:2736
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
        8⤵
        Launches sc.exe
        
        PID:3492
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        8⤵
        Launches sc.exe
        
        PID:2288
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "WSNKISKT"
        8⤵
        Launches sc.exe
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\onefile_6024_133629796317123554\stub.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
        6⤵
        
        PID:7088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:6964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:6916
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:6264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        7⤵
        
        PID:1380
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:5556
- - C:\Users\Admin\AppData\Local\Temp\1000016001\7cd067aa38.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\7cd067aa38.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetWindowsHookEx
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\1000017001\e9378efd62.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\e9378efd62.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4196
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fffa4799758,0x7fffa4799768,0x7fffa4799778
        5⤵
        
        PID:4824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:2
        5⤵
        
        PID:2316
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:8
        5⤵
        
        PID:4732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:8
        5⤵
        
        PID:2220
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2204 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:1
        5⤵
        
        PID:2868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:1
        5⤵
        
        PID:1528
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4560 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:1
        5⤵
        
        PID:5280
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4772 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:1
        5⤵
        
        PID:5928
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3848 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:8
        5⤵
        
        PID:6096
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:8
        5⤵
        
        PID:6104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:8
        5⤵
        
        PID:5332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1896,i,8546005789912529889,14633106147672494370,131072 /prefetch:8
        5⤵
        
        PID:5988

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:5728

C:\Users\Admin\AppData\Local\Temp\263c5c4d73\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\263c5c4d73\Hkbsse.exe
1⤵
PID:6484

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
PID:6492

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6324 -ip 6324
1⤵
PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6324 -ip 6324
1⤵
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6324 -ip 6324
1⤵
PID:6948

C:\Windows\system32\winsvc.exe
C:\Windows\system32\winsvc.exe
1⤵
PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\system32\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\Temp\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-SETACTIVE" "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4596
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -SETACTIVE 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    PID:5548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-ac" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5932
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change standby-timeout-ac 0
    3⤵
    PID:7096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-dc" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2972
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change standby-timeout-dc 0
    3⤵
    PID:6380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-ac" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1544
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change hibernate-timeout-ac 0
    3⤵
    PID:5532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-dc" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5696
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change hibernate-timeout-dc 0
    3⤵
    PID:3604
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "winnet.exe"
  2⤵
  - Kills process with taskkill
  PID:6992
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "winnet.exe"
  2⤵
  - Kills process with taskkill
  PID:5188
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "wincfg.exe"
  2⤵
  - Kills process with taskkill
  PID:3852
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "wincfg.exe"
  2⤵
  - Kills process with taskkill
  PID:6792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6324 -ip 6324
1⤵
PID:4512

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
PID:4520
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5820
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6812
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5808
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4904
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6336
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:6540
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5492
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:6648
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:3608
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:2424
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:3628
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:7052
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6324 -ip 6324
1⤵
PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6324 -ip 6324
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6324 -ip 6324
1⤵
PID:6628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6324 -ip 6324
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6324 -ip 6324
1⤵
PID:6696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6324 -ip 6324
1⤵
PID:6308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6324 -ip 6324
1⤵
PID:4236

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
1⤵
PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 440
  2⤵
  - Program crash
  PID:956

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:4536

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
PID:668

C:\Users\Admin\AppData\Local\Temp\263c5c4d73\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\263c5c4d73\Hkbsse.exe
1⤵
PID:6912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5844 -ip 5844
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5844 -ip 5844
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5844 -ip 5844
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5844 -ip 5844
1⤵
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1944 -ip 1944
1⤵
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5844 -ip 5844
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5844 -ip 5844
1⤵
PID:6492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5844 -ip 5844
1⤵
PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5844 -ip 5844
1⤵
PID:6468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5844 -ip 5844
1⤵
PID:5236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5844 -ip 5844
1⤵
PID:6724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5844 -ip 5844
1⤵
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5844 -ip 5844
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5844 -ip 5844
1⤵
PID:6716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5844 -ip 5844
1⤵
PID:7000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5844 -ip 5844
1⤵
PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion