amadey | a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	74a338dcd7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e2a2ea2540.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c7e1d9d72b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f63773d648.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f63773d648.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	74a338dcd7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e2a2ea2540.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c7e1d9d72b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f63773d648.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	74a338dcd7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c7e1d9d72b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e2a2ea2540.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Nework.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	BowExpert.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Waters.pif
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	splwow64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	74a338dcd7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	v10_stlr_x86_panam_x86_2024-09-24_18-38.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url	cmd.exe

Executes dropped EXE 51 IoCs

pid	Process
4300	axplong.exe
4448	gold.exe
2052	12dsvc.exe
3888	M65cDH3Q8D.exe
1288	zrb24LwgmK.exe
3488	Nework.exe
4432	Hkbsse.exe
3980	stealc_default2.exe
3880	needmoney.exe
244	penis.exe
232	acentric.exe
5072	2.exe
3316	Hkbsse.exe
704	axplong.exe
2724	svchost015.exe
3864	splwow64.exe
4016	crypted.exe
4988	f63773d648.exe
652	LummaC222222.exe
4384	Waters.pif
2856	66ed86be077bb_12.exe
2428	2.exe
3592	newbundle2.exe
4172	Blenar.exe
4328	Blenar.exe
244	74a338dcd7.exe
3964	skotes.exe
1696	BowExpert.exe
2372	Intake.pif
1580	e2a2ea2540.exe
2348	c7e1d9d72b.exe
4460	ff2614109a.exe
840	channel3.exe
5220	build.exe
5672	skotes.exe
5656	axplong.exe
5660	Hkbsse.exe
5996	service123.exe
5024	wsau.exe
5292	v10_stlr_x86_panam_x86_2024-09-24_18-38.exe
3776	PsInfo.exe
4748	PsInfo64.exe
5436	PsInfo64.exe
4568	PsInfo64.exe
6128	wsau.exe
4976	7za.exe
4836	RegAsm.exe
5352	Hkbsse.exe
5192	axplong.exe
5868	skotes.exe
5952	service123.exe

Identifies Wine through registry keys 2 TTPs 12 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	e2a2ea2540.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	c7e1d9d72b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	f63773d648.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	74a338dcd7.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	axplong.exe

Loads dropped DLL 12 IoCs

pid	Process
5072	2.exe
3980	stealc_default2.exe
3980	stealc_default2.exe
4328	Blenar.exe
4328	Blenar.exe
4328	Blenar.exe
4328	Blenar.exe
4328	Blenar.exe
4328	Blenar.exe
4328	Blenar.exe
5996	service123.exe
5952	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\splwow64.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000287001\\splwow64.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f63773d648.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000308001\\f63773d648.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\74a338dcd7.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000341000\\74a338dcd7.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e2a2ea2540.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000002001\\e2a2ea2540.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update"	acentric.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c7e1d9d72b.exe = "C:\\Users\\Admin\\1000015002\\c7e1d9d72b.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
206	ipinfo.io
207	ipinfo.io
193	api64.ipify.org
195	api64.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023595-747.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
2744	tasklist.exe
1704	tasklist.exe
4016	tasklist.exe
4928	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
4868	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
4300	axplong.exe
704	axplong.exe
4988	f63773d648.exe
244	74a338dcd7.exe
3964	skotes.exe
1580	e2a2ea2540.exe
2348	c7e1d9d72b.exe
5672	skotes.exe
5656	axplong.exe
5868	skotes.exe
5192	axplong.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4448 set thread context of 2784	4448	gold.exe	85
PID 2052 set thread context of 4152	2052	12dsvc.exe	89
PID 5072 set thread context of 3056	5072	2.exe	103
PID 3880 set thread context of 2724	3880	needmoney.exe	109
PID 4016 set thread context of 3488	4016	crypted.exe	118
PID 2856 set thread context of 5692	2856	66ed86be077bb_12.exe	179

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IpaqArthur	splwow64.exe
File created	C:\Windows\Tasks\skotes.job	74a338dcd7.exe
File created	C:\Windows\Tasks\axplong.job	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe
File opened for modification	C:\Windows\HardlyAircraft	splwow64.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0007000000023553-596.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 57 IoCs

pid	pid_target	Process	procid_target
1140	3056	WerFault.exe	103
6020	5220	WerFault.exe	181
5608	5220	WerFault.exe	181
6132	5220	WerFault.exe	181
4508	5220	WerFault.exe	181
5176	5220	WerFault.exe	181
5284	5220	WerFault.exe	181
5496	5220	WerFault.exe	181
5556	5220	WerFault.exe	181
4848	5220	WerFault.exe	181
3092	5220	WerFault.exe	181
232	5220	WerFault.exe	181
2828	5220	WerFault.exe	181
4740	5220	WerFault.exe	181
5292	5220	WerFault.exe	181
5360	5220	WerFault.exe	181
5496	5220	WerFault.exe	181
4836	5220	WerFault.exe	181
4928	5292	WerFault.exe	231
2900	5292	WerFault.exe	231
5748	5292	WerFault.exe	231
5476	5292	WerFault.exe	231
2944	5292	WerFault.exe	231
5884	5292	WerFault.exe	231
5640	5220	WerFault.exe	181
1688	5220	WerFault.exe	181
2932	5292	WerFault.exe	231
2900	5292	WerFault.exe	231
5256	5292	WerFault.exe	231
4064	5292	WerFault.exe	231
5328	5292	WerFault.exe	231
2428	5220	WerFault.exe	181
1648	5292	WerFault.exe	231
5324	5220	WerFault.exe	181
1496	5220	WerFault.exe	181
1920	5220	WerFault.exe	181
5584	5220	WerFault.exe	181
5976	5220	WerFault.exe	181
5484	5220	WerFault.exe	181
3104	5220	WerFault.exe	181
5552	5220	WerFault.exe	181
5672	5220	WerFault.exe	181
3512	5220	WerFault.exe	181
5972	5220	WerFault.exe	181
6056	5220	WerFault.exe	181
5944	5220	WerFault.exe	181
5656	5220	WerFault.exe	181
1496	5220	WerFault.exe	181
1896	5292	WerFault.exe	231
2424	5220	WerFault.exe	181
5396	5220	WerFault.exe	181
4772	5220	WerFault.exe	181
6096	5220	WerFault.exe	181
4964	5220	WerFault.exe	181
3880	5220	WerFault.exe	181
4772	5220	WerFault.exe	181
5160	5220	WerFault.exe	181

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	needmoney.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newbundle2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blenar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LummaC222222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f63773d648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	channel3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zrb24LwgmK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M65cDH3Q8D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Intake.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7e1d9d72b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12dsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	PsInfo64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	channel3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	PsInfo.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	PsInfo64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PsInfo64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PsInfo.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	PsInfo64.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	PsInfo64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	PsInfo64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	PsInfo.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PsInfo64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PsInfo64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	channel3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	PsInfo64.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
5556	systeminfo.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4008	schtasks.exe
3944	schtasks.exe
4172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4868	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
4868	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
4300	axplong.exe
4300	axplong.exe
3980	stealc_default2.exe
3980	stealc_default2.exe
1288	zrb24LwgmK.exe
2784	RegAsm.exe
3888	M65cDH3Q8D.exe
704	axplong.exe
704	axplong.exe
244	penis.exe
244	penis.exe
2784	RegAsm.exe
2784	RegAsm.exe
2784	RegAsm.exe
2784	RegAsm.exe
4988	f63773d648.exe
4988	f63773d648.exe
3980	stealc_default2.exe
3980	stealc_default2.exe
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
1288	zrb24LwgmK.exe
1288	zrb24LwgmK.exe
1288	zrb24LwgmK.exe
1288	zrb24LwgmK.exe
3488	RegAsm.exe
3488	RegAsm.exe
3488	RegAsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4460	ff2614109a.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	M65cDH3Q8D.exe
Token: SeBackupPrivilege	3888	M65cDH3Q8D.exe
Token: SeSecurityPrivilege	3888	M65cDH3Q8D.exe
Token: SeSecurityPrivilege	3888	M65cDH3Q8D.exe
Token: SeSecurityPrivilege	3888	M65cDH3Q8D.exe
Token: SeSecurityPrivilege	3888	M65cDH3Q8D.exe
Token: SeDebugPrivilege	244	penis.exe
Token: SeBackupPrivilege	244	penis.exe
Token: SeSecurityPrivilege	244	penis.exe
Token: SeSecurityPrivilege	244	penis.exe
Token: SeSecurityPrivilege	244	penis.exe
Token: SeSecurityPrivilege	244	penis.exe
Token: SeDebugPrivilege	1288	zrb24LwgmK.exe
Token: SeDebugPrivilege	2784	RegAsm.exe
Token: SeDebugPrivilege	2744	tasklist.exe
Token: SeDebugPrivilege	1704	tasklist.exe
Token: SeDebugPrivilege	3488	RegAsm.exe
Token: SeDebugPrivilege	232	acentric.exe
Token: SeDebugPrivilege	2856	66ed86be077bb_12.exe
Token: SeDebugPrivilege	4016	tasklist.exe
Token: SeDebugPrivilege	4928	tasklist.exe
Token: SeDebugPrivilege	3592	newbundle2.exe
Token: SeDebugPrivilege	1772	firefox.exe
Token: SeDebugPrivilege	1772	firefox.exe
Token: SeIncreaseQuotaPrivilege	5316	WMIC.exe
Token: SeSecurityPrivilege	5316	WMIC.exe
Token: SeTakeOwnershipPrivilege	5316	WMIC.exe
Token: SeLoadDriverPrivilege	5316	WMIC.exe
Token: SeSystemProfilePrivilege	5316	WMIC.exe
Token: SeSystemtimePrivilege	5316	WMIC.exe
Token: SeProfSingleProcessPrivilege	5316	WMIC.exe
Token: SeIncBasePriorityPrivilege	5316	WMIC.exe
Token: SeCreatePagefilePrivilege	5316	WMIC.exe
Token: SeBackupPrivilege	5316	WMIC.exe
Token: SeRestorePrivilege	5316	WMIC.exe
Token: SeShutdownPrivilege	5316	WMIC.exe
Token: SeDebugPrivilege	5316	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5316	WMIC.exe
Token: SeRemoteShutdownPrivilege	5316	WMIC.exe
Token: SeUndockPrivilege	5316	WMIC.exe
Token: SeManageVolumePrivilege	5316	WMIC.exe
Token: 33	5316	WMIC.exe
Token: 34	5316	WMIC.exe
Token: 35	5316	WMIC.exe
Token: 36	5316	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5316	WMIC.exe
Token: SeSecurityPrivilege	5316	WMIC.exe
Token: SeTakeOwnershipPrivilege	5316	WMIC.exe
Token: SeLoadDriverPrivilege	5316	WMIC.exe
Token: SeSystemProfilePrivilege	5316	WMIC.exe
Token: SeSystemtimePrivilege	5316	WMIC.exe
Token: SeProfSingleProcessPrivilege	5316	WMIC.exe
Token: SeIncBasePriorityPrivilege	5316	WMIC.exe
Token: SeCreatePagefilePrivilege	5316	WMIC.exe
Token: SeBackupPrivilege	5316	WMIC.exe
Token: SeRestorePrivilege	5316	WMIC.exe
Token: SeShutdownPrivilege	5316	WMIC.exe
Token: SeDebugPrivilege	5316	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5316	WMIC.exe
Token: SeRemoteShutdownPrivilege	5316	WMIC.exe
Token: SeUndockPrivilege	5316	WMIC.exe
Token: SeManageVolumePrivilege	5316	WMIC.exe
Token: 33	5316	WMIC.exe
Token: 34	5316	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4868	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
2372	Intake.pif
2372	Intake.pif
2372	Intake.pif
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4384	Waters.pif
4384	Waters.pif
4384	Waters.pif
2372	Intake.pif
2372	Intake.pif
2372	Intake.pif
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
1772	firefox.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe
4460	ff2614109a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1772	firefox.exe
1704	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4300	4868	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe	82
PID 4868 wrote to memory of 4300	4868	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe	82
PID 4868 wrote to memory of 4300	4868	a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe	82
PID 4300 wrote to memory of 4448	4300	axplong.exe	83
PID 4300 wrote to memory of 4448	4300	axplong.exe	83
PID 4300 wrote to memory of 4448	4300	axplong.exe	83
PID 4448 wrote to memory of 2784	4448	gold.exe	85
PID 4448 wrote to memory of 2784	4448	gold.exe	85
PID 4448 wrote to memory of 2784	4448	gold.exe	85
PID 4448 wrote to memory of 2784	4448	gold.exe	85
PID 4448 wrote to memory of 2784	4448	gold.exe	85
PID 4448 wrote to memory of 2784	4448	gold.exe	85
PID 4448 wrote to memory of 2784	4448	gold.exe	85
PID 4448 wrote to memory of 2784	4448	gold.exe	85
PID 4300 wrote to memory of 2052	4300	axplong.exe	86
PID 4300 wrote to memory of 2052	4300	axplong.exe	86
PID 4300 wrote to memory of 2052	4300	axplong.exe	86
PID 2052 wrote to memory of 4152	2052	12dsvc.exe	89
PID 2052 wrote to memory of 4152	2052	12dsvc.exe	89
PID 2052 wrote to memory of 4152	2052	12dsvc.exe	89
PID 2052 wrote to memory of 4152	2052	12dsvc.exe	89
PID 2052 wrote to memory of 4152	2052	12dsvc.exe	89
PID 2052 wrote to memory of 4152	2052	12dsvc.exe	89
PID 2052 wrote to memory of 4152	2052	12dsvc.exe	89
PID 2052 wrote to memory of 4152	2052	12dsvc.exe	89
PID 2052 wrote to memory of 4152	2052	12dsvc.exe	89
PID 2052 wrote to memory of 4152	2052	12dsvc.exe	89
PID 4152 wrote to memory of 3888	4152	RegAsm.exe	90
PID 4152 wrote to memory of 3888	4152	RegAsm.exe	90
PID 4152 wrote to memory of 3888	4152	RegAsm.exe	90
PID 4152 wrote to memory of 1288	4152	RegAsm.exe	91
PID 4152 wrote to memory of 1288	4152	RegAsm.exe	91
PID 4152 wrote to memory of 1288	4152	RegAsm.exe	91
PID 4300 wrote to memory of 3488	4300	axplong.exe	93
PID 4300 wrote to memory of 3488	4300	axplong.exe	93
PID 4300 wrote to memory of 3488	4300	axplong.exe	93
PID 3488 wrote to memory of 4432	3488	Nework.exe	94
PID 3488 wrote to memory of 4432	3488	Nework.exe	94
PID 3488 wrote to memory of 4432	3488	Nework.exe	94
PID 4300 wrote to memory of 3980	4300	axplong.exe	95
PID 4300 wrote to memory of 3980	4300	axplong.exe	95
PID 4300 wrote to memory of 3980	4300	axplong.exe	95
PID 4300 wrote to memory of 3880	4300	axplong.exe	96
PID 4300 wrote to memory of 3880	4300	axplong.exe	96
PID 4300 wrote to memory of 3880	4300	axplong.exe	96
PID 4300 wrote to memory of 244	4300	axplong.exe	98
PID 4300 wrote to memory of 244	4300	axplong.exe	98
PID 4300 wrote to memory of 244	4300	axplong.exe	98
PID 4300 wrote to memory of 232	4300	axplong.exe	100
PID 4300 wrote to memory of 232	4300	axplong.exe	100
PID 4300 wrote to memory of 232	4300	axplong.exe	100
PID 4300 wrote to memory of 5072	4300	axplong.exe	101
PID 4300 wrote to memory of 5072	4300	axplong.exe	101
PID 4300 wrote to memory of 5072	4300	axplong.exe	101
PID 5072 wrote to memory of 3056	5072	2.exe	103
PID 5072 wrote to memory of 3056	5072	2.exe	103
PID 5072 wrote to memory of 3056	5072	2.exe	103
PID 5072 wrote to memory of 3056	5072	2.exe	103
PID 5072 wrote to memory of 3056	5072	2.exe	103
PID 5072 wrote to memory of 3056	5072	2.exe	103
PID 5072 wrote to memory of 3056	5072	2.exe	103
PID 5072 wrote to memory of 3056	5072	2.exe	103
PID 5072 wrote to memory of 3056	5072	2.exe	103
PID 3880 wrote to memory of 2724	3880	needmoney.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3392
- C:\Users\Admin\AppData\Local\Temp\a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe
  "C:\Users\Admin\AppData\Local\Temp\a7398e1665efa4d2b3e8beff18e5a42d89e6a8a2a08e4548cabd9c32df04b3c5.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
    "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
      "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4152
      - C:\Users\Admin\AppData\Roaming\M65cDH3Q8D.exe
        
        "C:\Users\Admin\AppData\Roaming\M65cDH3Q8D.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3888
      - C:\Users\Admin\AppData\Roaming\zrb24LwgmK.exe
        
        "C:\Users\Admin\AppData\Roaming\zrb24LwgmK.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
      "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
      "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:244
  - - C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
      "C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:232
  - - C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
        5⤵
        
        PID:3056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 412
        6⤵
        Program crash
        
        PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe
      "C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:3864
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        5⤵
        
        PID:1912
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        
        PID:5020
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 607698
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "MaskBathroomCompositionInjection" Participants
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
        
        Waters.pif Q
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\1000440001\BowExpert.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000440001\BowExpert.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit
        8⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4016
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4928
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 684126
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "VegetablesIndividualBindingGba" Ever
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow C
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif
        
        Intake.pif C
        9⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\1000441001\channel3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000441001\channel3.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\1000442001\build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000442001\build.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 772
        8⤵
        Program crash
        
        PID:6020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 780
        8⤵
        Program crash
        
        PID:5608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 844
        8⤵
        Program crash
        
        PID:6132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 884
        8⤵
        Program crash
        
        PID:4508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 912
        8⤵
        Program crash
        
        PID:5176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 764
        8⤵
        Program crash
        
        PID:5284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1264
        8⤵
        Program crash
        
        PID:5496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1448
        8⤵
        Program crash
        
        PID:5556
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName > C:\Users\Admin\AppData\Local\temp\362 2>&1
        8⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1428
        8⤵
        Program crash
        
        PID:4848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1532
        8⤵
        Program crash
        
        PID:3092
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C type C:\Users\Admin\AppData\Local\temp\362 > C:\Users\Admin\AppData\Local\temp\312
        8⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1304
        8⤵
        Program crash
        
        PID:232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1028
        8⤵
        Program crash
        
        PID:2828
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cd "C:\Users\Admin\AppData\Roaming\CullinetProgram" & wsau.exe -o tsml.zip
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Roaming\CullinetProgram\wsau.exe
        
        wsau.exe -o tsml.zip
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1320
        8⤵
        Program crash
        
        PID:4740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1328
        8⤵
        Program crash
        
        PID:5292
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > C:\Users\Admin\AppData\Roaming\CullinetProgram\rtv 2>&1
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1648
        
        C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        9⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:5556
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /C:"OS Name"
        9⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1320
        8⤵
        Program crash
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\temp\v10_stlr_x86_panam_x86_2024-09-24_18-38.exe
        
        "C:\Users\Admin\AppData\Local\temp\v10_stlr_x86_panam_x86_2024-09-24_18-38.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 824
        9⤵
        Program crash
        
        PID:4928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 832
        9⤵
        Program crash
        
        PID:2900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 832
        9⤵
        Program crash
        
        PID:5748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 856
        9⤵
        Program crash
        
        PID:5476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 1084
        9⤵
        Program crash
        
        PID:2944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 1124
        9⤵
        Program crash
        
        PID:5884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 1152
        9⤵
        Program crash
        
        PID:2932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 1488
        9⤵
        Program crash
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cd "C:\Users\Admin\AppData\Roaming\CullinetProgram" & wsau.exe -o wvxk.zip
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:212
        
        C:\Users\Admin\AppData\Roaming\CullinetProgram\wsau.exe
        
        wsau.exe -o wvxk.zip
        10⤵
        Executes dropped EXE
        
        PID:6128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 1464
        9⤵
        Program crash
        
        PID:5256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 1652
        9⤵
        Program crash
        
        PID:4064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 1584
        9⤵
        Program crash
        
        PID:5328
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Roaming\CullinetProgram\7za.exe a -spf "C:\Users\Admin\AppData\Roaming\CullinetProgram\D3A12E1A39C438F62F8ECAC24639B3_FILES.7z" @C:\Users\Admin\AppData\Local\temp\470.txt
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Users\Admin\AppData\Roaming\CullinetProgram\7za.exe
        
        C:\Users\Admin\AppData\Roaming\CullinetProgram\7za.exe a -spf "C:\Users\Admin\AppData\Roaming\CullinetProgram\D3A12E1A39C438F62F8ECAC24639B3_FILES.7z" @C:\Users\Admin\AppData\Local\temp\470.txt
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 1380
        9⤵
        Program crash
        
        PID:1648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 1520
        9⤵
        Program crash
        
        PID:1896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1624
        8⤵
        Program crash
        
        PID:5496
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo.exe -s /accepteula applications > "C:\Users\Admin\AppData\Roaming\CullinetProgram\natxn"& "C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo64.exe" -s /accepteula applications >> "C:\Users\Admin\AppData\Roaming\CullinetProgram\natxn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo.exe
        
        C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo.exe -s /accepteula applications
        9⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3776
        
        C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo64.exe
        
        "C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo64.exe" -s /accepteula applications
        9⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1672
        8⤵
        Program crash
        
        PID:4836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1672
        8⤵
        Program crash
        
        PID:5640
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo64.exe -d /accepteula processor > "C:\Users\Admin\AppData\Roaming\CullinetProgram\natxn" & "C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo64.exe" /accepteula video >> "C:\Users\Admin\AppData\Roaming\CullinetProgram\natxn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
        
        C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo64.exe
        
        C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo64.exe -d /accepteula processor
        9⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5436
        
        C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo64.exe
        
        "C:\Users\Admin\AppData\Roaming\CullinetProgram\PsInfo64.exe" /accepteula video
        9⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1776
        8⤵
        Program crash
        
        PID:1688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1704
        8⤵
        Program crash
        
        PID:2428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1704
        8⤵
        Program crash
        
        PID:5324
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v CullinetProgram
        8⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v CullinetProgram
        9⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1616
        8⤵
        Program crash
        
        PID:1496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1632
        8⤵
        Program crash
        
        PID:1920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1784
        8⤵
        Program crash
        
        PID:5584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1748
        8⤵
        Program crash
        
        PID:5976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C SCHTASKS /QUERY /TN MyTasks\CullinetProgram
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /QUERY /TN MyTasks\CullinetProgram
        9⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1628
        8⤵
        Program crash
        
        PID:5484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1776
        8⤵
        Program crash
        
        PID:3104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1800
        8⤵
        Program crash
        
        PID:5552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1732
        8⤵
        Program crash
        
        PID:5672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1712
        8⤵
        Program crash
        
        PID:3512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v CullinetProgram
        8⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v CullinetProgram
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1732
        8⤵
        Program crash
        
        PID:5972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1712
        8⤵
        Program crash
        
        PID:6056
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1648
        8⤵
        Program crash
        
        PID:5944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1788
        8⤵
        Program crash
        
        PID:5656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C SCHTASKS /QUERY /TN MyTasks\CullinetProgram
        8⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /QUERY /TN MyTasks\CullinetProgram
        9⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1804
        8⤵
        Program crash
        
        PID:1496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1792
        8⤵
        Program crash
        
        PID:2424
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v CullinetProgram
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v CullinetProgram
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1844
        8⤵
        Program crash
        
        PID:5396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1656
        8⤵
        Program crash
        
        PID:4772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Environment /v UserInitMprLogonScript
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1856
        8⤵
        Program crash
        
        PID:6096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1776
        8⤵
        Program crash
        
        PID:4964
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C SCHTASKS /QUERY /TN MyTasks\CullinetProgram
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1772
        
        C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /QUERY /TN MyTasks\CullinetProgram
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1644
        8⤵
        Program crash
        
        PID:3880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1776
        8⤵
        Program crash
        
        PID:4772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v CullinetProgram
        8⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v CullinetProgram
        9⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 1736
        8⤵
        Program crash
        
        PID:5160
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:224
  - - C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4016
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\1000308001\f63773d648.exe
      "C:\Users\Admin\AppData\Local\Temp\1000308001\f63773d648.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
      "C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:652
  - - C:\Users\Admin\AppData\Local\Temp\1000318001\66ed86be077bb_12.exe
      "C:\Users\Admin\AppData\Local\Temp\1000318001\66ed86be077bb_12.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:2856
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\1000321001\2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000321001\2.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks processor information in registry
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5996
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe
      "C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe"
      4⤵
      Executes dropped EXE
      PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000340001\Blenar.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4328
  - - C:\Users\Admin\AppData\Roaming\1000341000\74a338dcd7.exe
      "C:\Users\Admin\AppData\Roaming\1000341000\74a338dcd7.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      PID:244
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\1000002001\e2a2ea2540.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000002001\e2a2ea2540.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1580
      - C:\Users\Admin\1000015002\c7e1d9d72b.exe
        
        "C:\Users\Admin\1000015002\c7e1d9d72b.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\1000019101\ff2614109a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000019101\ff2614109a.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4460
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
        7⤵
        
        PID:2480
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
        8⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1772
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1880 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1483f60-d2f1-4c92-b1b4-7d76e682767f} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" gpu
        9⤵
        
        PID:1076
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {332a1ef7-2f06-40e4-9789-04c0ae7c871c} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" socket
        9⤵
        
        PID:2112
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2944 -childID 1 -isForBrowser -prefsHandle 2872 -prefMapHandle 3176 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0092097-5981-4aca-a768-3fb2bcefc97b} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab
        9⤵
        
        PID:4120
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3964 -childID 2 -isForBrowser -prefsHandle 3216 -prefMapHandle 3324 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28a9c29d-53e8-4461-843c-ec2a6f2c3aba} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab
        9⤵
        
        PID:528
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4604 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4368 -prefMapHandle 4432 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6fd4273-cdf5-4a37-91b7-73e1d764c30e} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" utility
        9⤵
        Checks processor information in registry
        
        PID:5536
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5096 -childID 3 -isForBrowser -prefsHandle 5088 -prefMapHandle 5084 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3954885-2c3d-4017-995d-8e23d2bbc273} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab
        9⤵
        
        PID:1956
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -childID 4 -isForBrowser -prefsHandle 5244 -prefMapHandle 5240 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12c70f73-f751-4ada-92e0-6cbe0a0c656f} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab
        9⤵
        
        PID:4964
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 5 -isForBrowser -prefsHandle 5440 -prefMapHandle 5444 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bde72b43-204a-440f-bced-4871bb1ed35b} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" tab
        9⤵
        
        PID:2640
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
        7⤵
        
        PID:5972
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
        8⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 27735 -prefMapSize 245214 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7bb19eb-0b40-4ae0-ac39-44028ceda851} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" gpu
        9⤵
        
        PID:5012
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2348 -prefsLen 28655 -prefMapSize 245214 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bcb4be8-194b-493a-b697-dd8e58e0f99a} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" socket
        9⤵
        
        PID:5792
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3264 -childID 1 -isForBrowser -prefsHandle 3280 -prefMapHandle 3276 -prefsLen 25740 -prefMapSize 245214 -jsInitHandle 876 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a793c92-5fb1-47d3-aa44-e6b6a4daa6af} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" tab
        9⤵
        
        PID:3632
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4124 -childID 2 -isForBrowser -prefsHandle 4116 -prefMapHandle 4112 -prefsLen 33142 -prefMapSize 245214 -jsInitHandle 876 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ce07427-af54-429d-8603-cce797c70971} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" tab
        9⤵
        
        PID:5008
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4816 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4808 -prefMapHandle 4800 -prefsLen 33142 -prefMapSize 245214 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d633c71a-5a22-4d24-8a17-ac88cfd4af9c} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" utility
        9⤵
        Checks processor information in registry
        
        PID:4872
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5168 -childID 3 -isForBrowser -prefsHandle 5164 -prefMapHandle 5160 -prefsLen 30086 -prefMapSize 245214 -jsInitHandle 876 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9868409f-5e21-487c-806a-91b3fbdf89c7} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" tab
        9⤵
        
        PID:2480
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5332 -childID 4 -isForBrowser -prefsHandle 5340 -prefMapHandle 5344 -prefsLen 30086 -prefMapSize 245214 -jsInitHandle 876 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5475520e-d5f9-48b3-b774-573bad88f4ff} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" tab
        9⤵
        
        PID:5272
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 5 -isForBrowser -prefsHandle 5632 -prefMapHandle 5628 -prefsLen 30086 -prefMapSize 245214 -jsInitHandle 876 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5718a27a-36f7-4a05-95ff-43e952bb13fd} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" tab
        9⤵
        
        PID:5472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4008
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & echo URL="C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3056 -ip 3056
1⤵
PID:3088

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3316

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:704

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5672

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5656

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5220 -ip 5220
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5220 -ip 5220
1⤵
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5220 -ip 5220
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5220 -ip 5220
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5220 -ip 5220
1⤵
PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5220 -ip 5220
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5220 -ip 5220
1⤵
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5220 -ip 5220
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5220 -ip 5220
1⤵
PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5220 -ip 5220
1⤵
PID:5632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5220 -ip 5220
1⤵
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5220 -ip 5220
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5220 -ip 5220
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5220 -ip 5220
1⤵
PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5220 -ip 5220
1⤵
PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5220 -ip 5220
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5220 -ip 5220
1⤵
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5292 -ip 5292
1⤵
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5292 -ip 5292
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5292 -ip 5292
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5292 -ip 5292
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5292 -ip 5292
1⤵
PID:5152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5292 -ip 5292
1⤵
PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5220 -ip 5220
1⤵
PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5220 -ip 5220
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5292 -ip 5292
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5292 -ip 5292
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5292 -ip 5292
1⤵
PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5292 -ip 5292
1⤵
PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5292 -ip 5292
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5220 -ip 5220
1⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5292 -ip 5292
1⤵
PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5220 -ip 5220
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5220 -ip 5220
1⤵
PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5220 -ip 5220
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5220 -ip 5220
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5220 -ip 5220
1⤵
PID:6068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5220 -ip 5220
1⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5220 -ip 5220
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5220 -ip 5220
1⤵
PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5220 -ip 5220
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5220 -ip 5220
1⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5220 -ip 5220
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5220 -ip 5220
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5220 -ip 5220
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5220 -ip 5220
1⤵
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5220 -ip 5220
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5292 -ip 5292
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5220 -ip 5220
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5220 -ip 5220
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5220 -ip 5220
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5220 -ip 5220
1⤵
PID:5912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5220 -ip 5220
1⤵
PID:5524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5220 -ip 5220
1⤵
PID:4544

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:5352

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5192

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5868

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5220 -ip 5220
1⤵
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5220 -ip 5220
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion