amadey | f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce

Virtualization/Sandbox Evasion

Processes:

f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exeexplorti.exef0762e5cc7.exeaxplong.exeexplorti.exeaxplong.exeaxplong.exeexplorti.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f0762e5cc7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

explorti.exef0762e5cc7.exeaxplong.exeaxplong.exeexplorti.exeexplorti.exeaxplong.exef4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f0762e5cc7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f0762e5cc7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exeexplorti.exed42f45addf.exejsawdtyjde.exeRegAsm.exef0762e5cc7.exeaxplong.execlamer.exedropperrr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation	d42f45addf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation	jsawdtyjde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation	f0762e5cc7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation	clamer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation	dropperrr.exe

Executes dropped EXE 18 IoCs

Processes:

explorti.exed42f45addf.exee378e7234d.exef0762e5cc7.exeaxplong.exejsawdtyjde.execlamer.exethkdh.exedeepweb.exeexplorti.exeaxplong.exeglhe.exepureee.exeadada.exedropperrr.exesvchost.exeaxplong.exeexplorti.exe

pid	process
3900	explorti.exe
212	d42f45addf.exe
5556	e378e7234d.exe
5804	f0762e5cc7.exe
1832	axplong.exe
816	jsawdtyjde.exe
6268	clamer.exe
6484	thkdh.exe
6680	deepweb.exe
6584	explorti.exe
6588	axplong.exe
5132	glhe.exe
6976	pureee.exe
6864	adada.exe
5060	dropperrr.exe
7320	svchost.exe
7612	axplong.exe
7608	explorti.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

explorti.exef4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exeexplorti.exef0762e5cc7.exeaxplong.exeexplorti.exeaxplong.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Software\Wine	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
Key opened	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Software\Wine	f0762e5cc7.exe
Key opened	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Software\Wine	axplong.exe

Loads dropped DLL 7 IoCs

Processes:

MsiExec.exeMsiExec.exe

pid process

6868 MsiExec.exe
6868 MsiExec.exe
6868 MsiExec.exe
6868 MsiExec.exe
8640 MsiExec.exe
8640 MsiExec.exe
8640 MsiExec.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
6868	MsiExec.exe
6868	MsiExec.exe
6868	MsiExec.exe
6868	MsiExec.exe
8640	MsiExec.exe
8640	MsiExec.exe
8640	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorti.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d42f45addf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020001\\d42f45addf.exe"	explorti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e378e7234d.exe = "C:\\Users\\Admin\\1000029002\\e378e7234d.exe"	explorti.exe

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

223 7164 msiexec.exe
226 7164 msiexec.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

flow	pid	process
223	7164	msiexec.exe
226	7164	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

chrome.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exeexplorti.exee378e7234d.exef0762e5cc7.exeaxplong.exeexplorti.exeaxplong.exeexplorti.exeaxplong.exe

pid	process
3012	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
3900	explorti.exe
5556	e378e7234d.exe
5804	f0762e5cc7.exe
1832	axplong.exe
6584	explorti.exe
6588	axplong.exe
7608	explorti.exe
7612	axplong.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

deepweb.exepureee.exe

description	pid	process	target process
PID 6680 set thread context of 6752	6680	deepweb.exe	RegAsm.exe
PID 6976 set thread context of 9188	6976	pureee.exe	AddInProcess.exe
PID 6976 set thread context of 7088	6976	pureee.exe	AddInProcess.exe
PID 6976 set thread context of 7396	6976	pureee.exe	AddInProcess.exe
PID 6976 set thread context of 6452	6976	pureee.exe	AddInProcess.exe
PID 6976 set thread context of 6860	6976	pureee.exe	AddInProcess.exe
PID 6976 set thread context of 4924	6976	pureee.exe	AddInProcess.exe
PID 6976 set thread context of 7728	6976	pureee.exe	AddInProcess.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Sql.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\python27.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\QtWebEngineProcess.exe	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\curtainmode\CurtainMode64.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\resources\COMODO\oem.rcc	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\RCVirtualPrintDriver-manifest.ini	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\RCVirtualPrintDriverRenderFilter_x86-PipelineConfig.xml	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\RCVirtualPrintDriverRenderFilter_pdf_x64-PipelineConfig.xml	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5PrintSupport.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Qml.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\qtwebengine_resources.pak	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\RCVirtualPrintDriverRenderFilter_pdf_x86-PipelineConfig.xml	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\enrollment_settings.ini	MsiExec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\webrtc-plugin.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\edr-plugin.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\RCVirtualPrintDriverRenderFilter_x64-PipelineConfig.xml	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\curtainmode\CurtainMode32.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\offline_mode.ini	MsiExec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Core.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\rmmproxy.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\ssh-shellhost.exe	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5QuickWidgets.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\d3dcompiler_47.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Network.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Widgets.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\CatUninstaller.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5WebEngine.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\libEGL.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\RHost.exe	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\itsm\__init__.py	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\token.ini	MsiExec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\RCVirtualPrintDriverRenderFilter_x86.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\proxy_settings.ini	MsiExec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\sqldrivers\qsqlite.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Gui.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\libGLESV2.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\qtwebengine_resources_200p.pak	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\concrt140.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\plugindlls\MaintenanceWindowPlugin.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5WebEngineCore.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\msvcp140.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\imageformats\qjpeg.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\screenhooks32.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\ItsmRsp.exe	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Quick.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\qtwebengine_resources_100p.pak	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\imageformats\qgif.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\RCVirtualPrintDriver.inf	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\qdjango-db0.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\imageformats\qico.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\RCVirtualPrintDriverRenderFilter_x64.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\RCVirtualPrintDriver.gpd	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\platforms\qwindows.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\torrent-plugin.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\RDesktop.exe	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\rcvirtualprintdriver.cat	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5WebEngineWidgets.dll	msiexec.exe

Drops file in Windows directory 17 IoCs

Processes:

msiexec.exef0762e5cc7.exethkdh.exef4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe

description	ioc	process
File created	C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI834.tmp	msiexec.exe
File created	C:\Windows\Tasks\axplong.job	f0762e5cc7.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI804.tmp	msiexec.exe
File created	C:\Windows\Tasks\Test Task17.job	thkdh.exe
File created	C:\Windows\Installer\e5d0468.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d0468.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI61D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID39.tmp	msiexec.exe
File created	C:\Windows\Tasks\explorti.job	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5436 5556 WerFault.exe e378e7234d.exe

pid	pid_target	process	target process
5436	5556	WerFault.exe	e378e7234d.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exeexplorti.exedeepweb.exeMsiExec.exef0762e5cc7.exeaxplong.exeRegAsm.exedropperrr.exed42f45addf.exee378e7234d.exeMsiExec.execmd.exethkdh.exeglhe.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deepweb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0762e5cc7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dropperrr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d42f45addf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e378e7234d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thkdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	glhe.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 2 IoCs

Processes:

firefox.exedropperrr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000_Classes\Local Settings	dropperrr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

5112 schtasks.exe
4452 schtasks.exe

pid	process
5112	schtasks.exe
4452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exeexplorti.exemsedge.exemsedge.exechrome.exef0762e5cc7.exeaxplong.exeRegAsm.exeexplorti.exeaxplong.exepureee.exeexplorti.exeaxplong.exemsiexec.exe

pid	process
3012	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
3012	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
3900	explorti.exe
3900	explorti.exe
3044	msedge.exe
3044	msedge.exe
2868	msedge.exe
2868	msedge.exe
2664	chrome.exe
2664	chrome.exe
5804	f0762e5cc7.exe
5804	f0762e5cc7.exe
1832	axplong.exe
1832	axplong.exe
6752	RegAsm.exe
6752	RegAsm.exe
6752	RegAsm.exe
6584	explorti.exe
6584	explorti.exe
6588	axplong.exe
6588	axplong.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
7608	explorti.exe
7612	axplong.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
7156	msiexec.exe
7156	msiexec.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe
6976	pureee.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exechrome.exe

pid process

2868 msedge.exe
2868 msedge.exe
2664 chrome.exe
2664 chrome.exe
2868 msedge.exe

pid	process
2868	msedge.exe
2868	msedge.exe
2664	chrome.exe
2664	chrome.exe
2868	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exechrome.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeDebugPrivilege	2988	firefox.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeDebugPrivilege	6752	RegAsm.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exefirefox.exemsedge.exechrome.exe

pid	process
3012	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exemsedge.exechrome.exe

pid	process
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2988	firefox.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

firefox.exee378e7234d.exe

pid process

2988 firefox.exe
5556 e378e7234d.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exeexplorti.exed42f45addf.execmd.exechrome.exemsedge.exefirefox.exefirefox.exe

description	pid	process	target process
PID 3012 wrote to memory of 3900	3012	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe	explorti.exe
PID 3012 wrote to memory of 3900	3012	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe	explorti.exe
PID 3012 wrote to memory of 3900	3012	f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe	explorti.exe
PID 3900 wrote to memory of 212	3900	explorti.exe	d42f45addf.exe
PID 3900 wrote to memory of 212	3900	explorti.exe	d42f45addf.exe
PID 3900 wrote to memory of 212	3900	explorti.exe	d42f45addf.exe
PID 212 wrote to memory of 1160	212	d42f45addf.exe	cmd.exe
PID 212 wrote to memory of 1160	212	d42f45addf.exe	cmd.exe
PID 1160 wrote to memory of 2664	1160	cmd.exe	chrome.exe
PID 1160 wrote to memory of 2664	1160	cmd.exe	chrome.exe
PID 1160 wrote to memory of 2868	1160	cmd.exe	msedge.exe
PID 1160 wrote to memory of 2868	1160	cmd.exe	msedge.exe
PID 1160 wrote to memory of 2736	1160	cmd.exe	firefox.exe
PID 1160 wrote to memory of 2736	1160	cmd.exe	firefox.exe
PID 2664 wrote to memory of 4256	2664	chrome.exe	chrome.exe
PID 2664 wrote to memory of 4256	2664	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2040	2868	msedge.exe	msedge.exe
PID 2868 wrote to memory of 2040	2868	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2736 wrote to memory of 2988	2736	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe
PID 2988 wrote to memory of 4372	2988	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe
"C:\Users\Admin\AppData\Local\Temp\f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3012

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3900

C:\Users\Admin\AppData\Local\Temp\1000020001\d42f45addf.exe
"C:\Users\Admin\AppData\Local\Temp\1000020001\d42f45addf.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\600E.tmp\600F.tmp\6010.bat C:\Users\Admin\AppData\Local\Temp\1000020001\d42f45addf.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9c6e8cc40,0x7ff9c6e8cc4c,0x7ff9c6e8cc58
6⤵
PID:4256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,2160292829993695174,13107373814861137253,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=1916 /prefetch:2
6⤵
PID:4584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,2160292829993695174,13107373814861137253,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2200 /prefetch:3
6⤵
PID:4752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,2160292829993695174,13107373814861137253,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2260 /prefetch:8
6⤵
PID:1528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3144,i,2160292829993695174,13107373814861137253,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3208 /prefetch:1
6⤵
PID:4764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,2160292829993695174,13107373814861137253,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3232 /prefetch:1
6⤵
PID:5072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=220,i,2160292829993695174,13107373814861137253,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4600 /prefetch:8
6⤵
- Drops file in System32 directory
PID:9064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9c6d446f8,0x7ff9c6d44708,0x7ff9c6d44718
6⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1288087401917952318,12147926574540698710,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
6⤵
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1288087401917952318,12147926574540698710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,1288087401917952318,12147926574540698710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
6⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1288087401917952318,12147926574540698710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
6⤵
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1288087401917952318,12147926574540698710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
6⤵
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1288087401917952318,12147926574540698710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
6⤵
PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1288087401917952318,12147926574540698710,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
6⤵
PID:9168

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
5⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {156e0aec-bca6-4f94-a198-ba3136a75a97} 2988 "\\.\pipe\gecko-crash-server-pipe.2988" gpu
7⤵
PID:4372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2392 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00c11624-cd53-4f2c-b62e-40a4e3bf8ee1} 2988 "\\.\pipe\gecko-crash-server-pipe.2988" socket
7⤵
PID:3740

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1448 -childID 1 -isForBrowser -prefsHandle 2628 -prefMapHandle 2872 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a70bca7-0a2b-4c7a-913f-74b68ceb9488} 2988 "\\.\pipe\gecko-crash-server-pipe.2988" tab
7⤵
PID:2884

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1308 -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 2956 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3a880cb-bb4f-4dc2-b9c9-ec225add4fbc} 2988 "\\.\pipe\gecko-crash-server-pipe.2988" tab
7⤵
PID:1376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4128 -prefMapHandle 4164 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49c5470e-98b9-449c-a346-010d520141d7} 2988 "\\.\pipe\gecko-crash-server-pipe.2988" utility
7⤵
- Checks processor information in registry
PID:5676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5444 -childID 3 -isForBrowser -prefsHandle 5432 -prefMapHandle 5372 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fda17f0-70c8-4bfb-a81c-51c26cf43076} 2988 "\\.\pipe\gecko-crash-server-pipe.2988" tab
7⤵
PID:6100

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 4 -isForBrowser -prefsHandle 5568 -prefMapHandle 5432 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ef5b24b-4793-477c-9b6e-c2cf8a66ecd3} 2988 "\\.\pipe\gecko-crash-server-pipe.2988" tab
7⤵
PID:5228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5820 -childID 5 -isForBrowser -prefsHandle 5740 -prefMapHandle 5748 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {628cb62d-0bdc-463f-8abf-d03bea636aed} 2988 "\\.\pipe\gecko-crash-server-pipe.2988" tab
7⤵
PID:5240

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
3⤵
PID:5408

C:\Users\Admin\1000029002\e378e7234d.exe
"C:\Users\Admin\1000029002\e378e7234d.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 1116
4⤵
- Program crash
PID:5436

C:\Users\Admin\AppData\Local\Temp\1000030001\f0762e5cc7.exe
"C:\Users\Admin\AppData\Local\Temp\1000030001\f0762e5cc7.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5804

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1832

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe
"C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
6⤵
PID:2448

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
clamer.exe -priverdD
7⤵
- Checks computer location settings
- Executes dropped EXE
PID:6268

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"
8⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6484

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe
"C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:6680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6752

C:\Users\Admin\AppData\Local\Temp\pureee.exe
"C:\Users\Admin\AppData\Local\Temp\pureee.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:6976

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:9188

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:7088

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:7396

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:6452

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:6860

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:4924

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:7728

C:\Users\Admin\AppData\Local\Temp\adada.exe
"C:\Users\Admin\AppData\Local\Temp\adada.exe"
7⤵
- Executes dropped EXE
PID:6864

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
8⤵
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
8⤵
- Executes dropped EXE
PID:7320

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
9⤵
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"
7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5060

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DirectX11\em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi"
8⤵
- Blocklisted process makes network request
- Enumerates connected drives
PID:7164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5248

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5556 -ip 5556
1⤵
PID:628

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6584

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6588

C:\ProgramData\kcsnc\glhe.exe
C:\ProgramData\kcsnc\glhe.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5132

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7612

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7608

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:7156

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 71261C620F8E184C4A94934EE9CCDB8E
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6868

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 382CA91FCAA1BC78776CDC3148915326 E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:8640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
3⤵
- System Location Discovery: System Language Discovery
PID:8684

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && rmdir /S /Q DLLs Lib"
3⤵
PID:8744

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion