amadey | 63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27

Virtualization/Sandbox Evasion

Processes:

f501b77537.exeskotes.exeaxplong.exe3ee1417c16.exe63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exea004a540be.exeskotes.exeskotes.exeaxplong.exeaxplong.exebba0c3abf8.exe575dd4f678.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f501b77537.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3ee1417c16.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a004a540be.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bba0c3abf8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	575dd4f678.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1268 powershell.exe
1032 powershell.exe
3188 powershell.exe
4800 powershell.exe
Downloads MZ/PE file

pid	process
1268	powershell.exe
1032	powershell.exe
3188	powershell.exe
4800	powershell.exe

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

axplong.exeaxplong.exea004a540be.exebba0c3abf8.exe575dd4f678.exeskotes.exef501b77537.exeaxplong.exe3ee1417c16.exeskotes.exe63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exeskotes.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a004a540be.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a004a540be.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bba0c3abf8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	575dd4f678.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	575dd4f678.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bba0c3abf8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f501b77537.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3ee1417c16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3ee1417c16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f501b77537.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

axplong.exeNework.exeHkbsse.exePkContent.exeWaters.pif63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe12dsvc.exebba0c3abf8.exeskotes.exesplwow64.exeprocessclass.execontext.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Nework.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Hkbsse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	PkContent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Waters.pif
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	12dsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	bba0c3abf8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	splwow64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	processclass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	context.exe

Drops startup file 4 IoCs

Processes:

cmd.execmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url	cmd.exe

Executes dropped EXE 39 IoCs

Processes:

axplong.exegold.exe12dsvc.exeIdAWoHABkS.exeYRZaaJxhFW.exeNework.exeHkbsse.exestealc_default2.exeneedmoney.exepenis.execrypted.exesvchost015.exeLummaC222222.exenewbundle2.exerstxdhuj.exea004a540be.exebba0c3abf8.exeskotes.exejavumar2.exejavumar2.tmplummetc.exeprocessclass.exejavtestnoreport.exef501b77537.exesplwow64.exe575dd4f678.exePkContent.exeskotes.exeHkbsse.exeaxplong.exe3ee1417c16.exeWaters.pifcontext.exeThermal.pifWaters.pifRegAsm.exeHkbsse.exeaxplong.exeskotes.exe

pid	process
2904	axplong.exe
3760	gold.exe
2428	12dsvc.exe
2336	IdAWoHABkS.exe
4508	YRZaaJxhFW.exe
1728	Nework.exe
2420	Hkbsse.exe
1020	stealc_default2.exe
3760	needmoney.exe
2492	penis.exe
452	crypted.exe
3216	svchost015.exe
1248	LummaC222222.exe
1960	newbundle2.exe
936	rstxdhuj.exe
5508	a004a540be.exe
5892	bba0c3abf8.exe
5952	skotes.exe
1576	javumar2.exe
5296	javumar2.tmp
4916	lummetc.exe
5772	processclass.exe
5768	javtestnoreport.exe
2348	f501b77537.exe
5216	splwow64.exe
1088	575dd4f678.exe
5612	PkContent.exe
5368	skotes.exe
5400	Hkbsse.exe
5156	axplong.exe
5420	3ee1417c16.exe
6332	Waters.pif
7100	context.exe
7460	Thermal.pif
7352	Waters.pif
7564	RegAsm.exe
4012	Hkbsse.exe
5816	axplong.exe
808	skotes.exe

Identifies Wine through registry keys 2 TTPs 12 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

f501b77537.exe575dd4f678.exe3ee1417c16.exeskotes.exe63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exeaxplong.exebba0c3abf8.exeskotes.exea004a540be.exeskotes.exeaxplong.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	f501b77537.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	575dd4f678.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	3ee1417c16.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	bba0c3abf8.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	a004a540be.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine	axplong.exe

Loads dropped DLL 4 IoCs

Processes:

stealc_default2.exejavumar2.tmp

pid process

1020 stealc_default2.exe
1020 stealc_default2.exe
5296 javumar2.tmp
5296 javumar2.tmp
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1020	stealc_default2.exe
1020	stealc_default2.exe
5296	javumar2.tmp
5296	javumar2.tmp

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rstxdhuj.exeaxplong.exeskotes.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe"	rstxdhuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a004a540be.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\a004a540be.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bba0c3abf8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\bba0c3abf8.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f501b77537.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\f501b77537.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\575dd4f678.exe = "C:\\Users\\Admin\\1000026002\\575dd4f678.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates processes with tasklist 1 TTPs 6 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid process

6432 tasklist.exe
6980 tasklist.exe
7088 tasklist.exe
6060 tasklist.exe
3036 tasklist.exe
6460 tasklist.exe

pid	process
6432	tasklist.exe
6980	tasklist.exe
7088	tasklist.exe
6060	tasklist.exe
3036	tasklist.exe
6460	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

Processes:

63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exeaxplong.exea004a540be.exebba0c3abf8.exeskotes.exef501b77537.exe575dd4f678.exeaxplong.exeskotes.exe3ee1417c16.exeskotes.exeaxplong.exe

pid	process
4876	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
2904	axplong.exe
5508	a004a540be.exe
5892	bba0c3abf8.exe
5952	skotes.exe
2348	f501b77537.exe
1088	575dd4f678.exe
5156	axplong.exe
5368	skotes.exe
5420	3ee1417c16.exe
808	skotes.exe
5816	axplong.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

gold.exeneedmoney.execrypted.exerstxdhuj.exe

description	pid	process	target process
PID 3760 set thread context of 4072	3760	gold.exe	RegAsm.exe
PID 3760 set thread context of 3216	3760	needmoney.exe	svchost015.exe
PID 452 set thread context of 4696	452	crypted.exe	RegAsm.exe
PID 936 set thread context of 5212	936	rstxdhuj.exe	InstallUtil.exe

Drops file in Program Files directory 4 IoCs

Processes:

chrmstp.exechrmstp.exechrmstp.exechrmstp.exe

description	ioc	process
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe

Drops file in Windows directory 17 IoCs

Processes:

PkContent.exeNework.exesplwow64.execontext.exe63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exebba0c3abf8.exe

description	ioc	process
File opened for modification	C:\Windows\FirewireBros	PkContent.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe
File opened for modification	C:\Windows\IpaqArthur	splwow64.exe
File opened for modification	C:\Windows\PgJune	PkContent.exe
File opened for modification	C:\Windows\PorcelainExhaust	PkContent.exe
File opened for modification	C:\Windows\PortugalCharges	PkContent.exe
File opened for modification	C:\Windows\ViewpictureKingdom	context.exe
File created	C:\Windows\Tasks\axplong.job	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
File created	C:\Windows\Tasks\skotes.job	bba0c3abf8.exe
File opened for modification	C:\Windows\HardlyAircraft	splwow64.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64.exe
File opened for modification	C:\Windows\MonsterRaymond	PkContent.exe
File opened for modification	C:\Windows\HardlyAircraft	context.exe
File opened for modification	C:\Windows\ReceptorsTeeth	PkContent.exe
File opened for modification	C:\Windows\BrandonBlind	context.exe
File opened for modification	C:\Windows\IpaqArthur	context.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5648 1248 WerFault.exe LummaC222222.exe
5884 4916 WerFault.exe lummetc.exe

pid	pid_target	process	target process
5648	1248	WerFault.exe	LummaC222222.exe
5884	4916	WerFault.exe	lummetc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

gold.exea004a540be.exesplwow64.exefindstr.exefindstr.execmd.exetasklist.exeschtasks.execmd.exeNework.exepowershell.exepowershell.exetasklist.exefindstr.exetasklist.exetasklist.exeRegAsm.exe12dsvc.exeIdAWoHABkS.exesvchost015.execmd.exeThermal.piffindstr.exeaxplong.exeHkbsse.exeskotes.execmd.exetasklist.exetaskkill.execrypted.execmd.exeYRZaaJxhFW.execmd.execmd.execmd.exe63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exerstxdhuj.execmd.execmd.exetimeout.exebba0c3abf8.exelummetc.exepowershell.execontext.exeWaters.pifcmd.exef501b77537.exe575dd4f678.exeWaters.pifcmd.exePkContent.exefindstr.execmd.exeRegAsm.exestealc_default2.exenewbundle2.exepowershell.exefindstr.exechoice.exeRegAsm.exeInstallUtil.exe3ee1417c16.exefindstr.exeneedmoney.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a004a540be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12dsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IdAWoHABkS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Thermal.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YRZaaJxhFW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rstxdhuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bba0c3abf8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lummetc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f501b77537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	575dd4f678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PkContent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newbundle2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ee1417c16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	needmoney.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

stealc_default2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

8048 timeout.exe

pid	process
8048	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

7148 taskkill.exe

pid	process
7148	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133719604282905652"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrmstp.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ chrmstp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

7088 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

InstallUtil.exe

pid process

5212 InstallUtil.exe

pid	process
7088	schtasks.exe

pid	process
5212	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exeaxplong.exestealc_default2.exeIdAWoHABkS.exeRegAsm.exeYRZaaJxhFW.exepenis.exerstxdhuj.exea004a540be.exeRegAsm.exenewbundle2.exebba0c3abf8.exepowershell.exeskotes.exejavtestnoreport.exepowershell.exef501b77537.exeInstallUtil.exe575dd4f678.exeaxplong.exeskotes.exepowershell.exemsedge.exe

pid	process
4876	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
4876	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
2904	axplong.exe
2904	axplong.exe
1020	stealc_default2.exe
1020	stealc_default2.exe
2336	IdAWoHABkS.exe
4072	RegAsm.exe
4072	RegAsm.exe
4072	RegAsm.exe
4072	RegAsm.exe
4072	RegAsm.exe
4508	YRZaaJxhFW.exe
4508	YRZaaJxhFW.exe
4508	YRZaaJxhFW.exe
4508	YRZaaJxhFW.exe
4508	YRZaaJxhFW.exe
4508	YRZaaJxhFW.exe
2492	penis.exe
2492	penis.exe
936	rstxdhuj.exe
936	rstxdhuj.exe
5508	a004a540be.exe
5508	a004a540be.exe
4696	RegAsm.exe
4696	RegAsm.exe
1020	stealc_default2.exe
1020	stealc_default2.exe
1960	newbundle2.exe
1960	newbundle2.exe
5892	bba0c3abf8.exe
5892	bba0c3abf8.exe
4696	RegAsm.exe
4696	RegAsm.exe
4696	RegAsm.exe
4696	RegAsm.exe
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
5952	skotes.exe
5952	skotes.exe
5768	javtestnoreport.exe
5768	javtestnoreport.exe
3188	powershell.exe
3188	powershell.exe
3188	powershell.exe
2348	f501b77537.exe
2348	f501b77537.exe
5212	InstallUtil.exe
5212	InstallUtil.exe
1088	575dd4f678.exe
1088	575dd4f678.exe
5156	axplong.exe
5156	axplong.exe
5368	skotes.exe
5368	skotes.exe
1960	newbundle2.exe
1960	newbundle2.exe
1960	newbundle2.exe
1960	newbundle2.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
5184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

Processes:

msedge.exechrome.exe

pid	process
3120	msedge.exe
3120	msedge.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
3120	msedge.exe
3120	msedge.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

IdAWoHABkS.exeRegAsm.exepenis.exeYRZaaJxhFW.exerstxdhuj.exeRegAsm.exenewbundle2.exeInstallUtil.exepowershell.exepowershell.exepowershell.exechrome.exepowershell.exetasklist.exetasklist.exeprocessclass.exetasklist.exetasklist.exetasklist.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	2336	IdAWoHABkS.exe
Token: SeBackupPrivilege	2336	IdAWoHABkS.exe
Token: SeSecurityPrivilege	2336	IdAWoHABkS.exe
Token: SeSecurityPrivilege	2336	IdAWoHABkS.exe
Token: SeSecurityPrivilege	2336	IdAWoHABkS.exe
Token: SeSecurityPrivilege	2336	IdAWoHABkS.exe
Token: SeDebugPrivilege	4072	RegAsm.exe
Token: SeDebugPrivilege	2492	penis.exe
Token: SeBackupPrivilege	2492	penis.exe
Token: SeSecurityPrivilege	2492	penis.exe
Token: SeSecurityPrivilege	2492	penis.exe
Token: SeSecurityPrivilege	2492	penis.exe
Token: SeSecurityPrivilege	2492	penis.exe
Token: SeDebugPrivilege	4508	YRZaaJxhFW.exe
Token: SeDebugPrivilege	936	rstxdhuj.exe
Token: SeDebugPrivilege	936	rstxdhuj.exe
Token: SeDebugPrivilege	4696	RegAsm.exe
Token: SeDebugPrivilege	1960	newbundle2.exe
Token: SeDebugPrivilege	5212	InstallUtil.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	5212	InstallUtil.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeDebugPrivilege	6980	tasklist.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeDebugPrivilege	7088	tasklist.exe
Token: SeDebugPrivilege	5772	processclass.exe
Token: SeDebugPrivilege	6060	tasklist.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeDebugPrivilege	3036	tasklist.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeDebugPrivilege	6460	tasklist.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeDebugPrivilege	6432	tasklist.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

Processes:

63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exemsedge.exechrome.exechrmstp.exeWaters.pifThermal.pifWaters.pif

pid	process
4876	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
6732	chrmstp.exe
6332	Waters.pif
6332	Waters.pif
6332	Waters.pif
7460	Thermal.pif
7460	Thermal.pif
7460	Thermal.pif
7352	Waters.pif
7352	Waters.pif
7352	Waters.pif

Suspicious use of SendNotifyMessage 33 IoCs

Processes:

msedge.exeWaters.pifThermal.pifWaters.pif

pid	process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
6332	Waters.pif
6332	Waters.pif
6332	Waters.pif
7460	Thermal.pif
7460	Thermal.pif
7460	Thermal.pif
7352	Waters.pif
7352	Waters.pif
7352	Waters.pif

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

InstallUtil.exeRegAsm.exe

pid process

5212 InstallUtil.exe
7564 RegAsm.exe

pid	process
5212	InstallUtil.exe
7564	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exeaxplong.exegold.exe12dsvc.exeNework.exeneedmoney.execrypted.exe

description	pid	process	target process
PID 4876 wrote to memory of 2904	4876	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe	axplong.exe
PID 4876 wrote to memory of 2904	4876	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe	axplong.exe
PID 4876 wrote to memory of 2904	4876	63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe	axplong.exe
PID 2904 wrote to memory of 3760	2904	axplong.exe	gold.exe
PID 2904 wrote to memory of 3760	2904	axplong.exe	gold.exe
PID 2904 wrote to memory of 3760	2904	axplong.exe	gold.exe
PID 3760 wrote to memory of 4072	3760	gold.exe	RegAsm.exe
PID 3760 wrote to memory of 4072	3760	gold.exe	RegAsm.exe
PID 3760 wrote to memory of 4072	3760	gold.exe	RegAsm.exe
PID 3760 wrote to memory of 4072	3760	gold.exe	RegAsm.exe
PID 3760 wrote to memory of 4072	3760	gold.exe	RegAsm.exe
PID 3760 wrote to memory of 4072	3760	gold.exe	RegAsm.exe
PID 3760 wrote to memory of 4072	3760	gold.exe	RegAsm.exe
PID 3760 wrote to memory of 4072	3760	gold.exe	RegAsm.exe
PID 2904 wrote to memory of 2428	2904	axplong.exe	12dsvc.exe
PID 2904 wrote to memory of 2428	2904	axplong.exe	12dsvc.exe
PID 2904 wrote to memory of 2428	2904	axplong.exe	12dsvc.exe
PID 2428 wrote to memory of 2336	2428	12dsvc.exe	IdAWoHABkS.exe
PID 2428 wrote to memory of 2336	2428	12dsvc.exe	IdAWoHABkS.exe
PID 2428 wrote to memory of 2336	2428	12dsvc.exe	IdAWoHABkS.exe
PID 2428 wrote to memory of 4508	2428	12dsvc.exe	YRZaaJxhFW.exe
PID 2428 wrote to memory of 4508	2428	12dsvc.exe	YRZaaJxhFW.exe
PID 2428 wrote to memory of 4508	2428	12dsvc.exe	YRZaaJxhFW.exe
PID 2904 wrote to memory of 1728	2904	axplong.exe	Nework.exe
PID 2904 wrote to memory of 1728	2904	axplong.exe	Nework.exe
PID 2904 wrote to memory of 1728	2904	axplong.exe	Nework.exe
PID 1728 wrote to memory of 2420	1728	Nework.exe	Hkbsse.exe
PID 1728 wrote to memory of 2420	1728	Nework.exe	Hkbsse.exe
PID 1728 wrote to memory of 2420	1728	Nework.exe	Hkbsse.exe
PID 2904 wrote to memory of 1020	2904	axplong.exe	stealc_default2.exe
PID 2904 wrote to memory of 1020	2904	axplong.exe	stealc_default2.exe
PID 2904 wrote to memory of 1020	2904	axplong.exe	stealc_default2.exe
PID 2904 wrote to memory of 3760	2904	axplong.exe	needmoney.exe
PID 2904 wrote to memory of 3760	2904	axplong.exe	needmoney.exe
PID 2904 wrote to memory of 3760	2904	axplong.exe	needmoney.exe
PID 2904 wrote to memory of 2492	2904	axplong.exe	penis.exe
PID 2904 wrote to memory of 2492	2904	axplong.exe	penis.exe
PID 2904 wrote to memory of 2492	2904	axplong.exe	penis.exe
PID 2904 wrote to memory of 452	2904	axplong.exe	crypted.exe
PID 2904 wrote to memory of 452	2904	axplong.exe	crypted.exe
PID 2904 wrote to memory of 452	2904	axplong.exe	crypted.exe
PID 3760 wrote to memory of 3216	3760	needmoney.exe	svchost015.exe
PID 3760 wrote to memory of 3216	3760	needmoney.exe	svchost015.exe
PID 3760 wrote to memory of 3216	3760	needmoney.exe	svchost015.exe
PID 3760 wrote to memory of 3216	3760	needmoney.exe	svchost015.exe
PID 3760 wrote to memory of 3216	3760	needmoney.exe	svchost015.exe
PID 3760 wrote to memory of 3216	3760	needmoney.exe	svchost015.exe
PID 3760 wrote to memory of 3216	3760	needmoney.exe	svchost015.exe
PID 3760 wrote to memory of 3216	3760	needmoney.exe	svchost015.exe
PID 452 wrote to memory of 4696	452	crypted.exe	RegAsm.exe
PID 452 wrote to memory of 4696	452	crypted.exe	RegAsm.exe
PID 452 wrote to memory of 4696	452	crypted.exe	RegAsm.exe
PID 452 wrote to memory of 4696	452	crypted.exe	RegAsm.exe
PID 452 wrote to memory of 4696	452	crypted.exe	RegAsm.exe
PID 452 wrote to memory of 4696	452	crypted.exe	RegAsm.exe
PID 452 wrote to memory of 4696	452	crypted.exe	RegAsm.exe
PID 452 wrote to memory of 4696	452	crypted.exe	RegAsm.exe
PID 2904 wrote to memory of 1248	2904	axplong.exe	LummaC222222.exe
PID 2904 wrote to memory of 1248	2904	axplong.exe	LummaC222222.exe
PID 2904 wrote to memory of 1248	2904	axplong.exe	LummaC222222.exe
PID 2904 wrote to memory of 1960	2904	axplong.exe	newbundle2.exe
PID 2904 wrote to memory of 1960	2904	axplong.exe	newbundle2.exe
PID 2904 wrote to memory of 1960	2904	axplong.exe	newbundle2.exe
PID 2904 wrote to memory of 936	2904	axplong.exe	rstxdhuj.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3500

C:\Users\Admin\AppData\Local\Temp\63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe
"C:\Users\Admin\AppData\Local\Temp\63abcbcb622d3c9511c72105b56ddf7afb4c33537348edc53adf3f27ff9cdf27.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4876

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2904

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
"C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428

C:\Users\Admin\AppData\Roaming\IdAWoHABkS.exe
"C:\Users\Admin\AppData\Roaming\IdAWoHABkS.exe"
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Users\Admin\AppData\Roaming\YRZaaJxhFW.exe
"C:\Users\Admin\AppData\Roaming\YRZaaJxhFW.exe"
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2420

C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe
"C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe"
6⤵
- Executes dropped EXE
PID:1576

C:\Users\Admin\AppData\Local\Temp\is-QP22H.tmp\javumar2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-QP22H.tmp\javumar2.tmp" /SL5="$B01D2,12434628,845824,C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5296

C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe
"C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5768

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1020

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3760

C:\Users\Admin\AppData\Local\Temp\svchost015.exe
C:\Users\Admin\AppData\Local\Temp\svchost015.exe
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3216

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
"C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"
4⤵
- Executes dropped EXE
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 1228
5⤵
- Program crash
PID:5648

C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
"C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yoodrabodoln.beget.app/Px5rcr?&se_referrer=&default_keyword=&
5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7b2f46f8,0x7ffe7b2f4708,0x7ffe7b2f4718
6⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5631382322071792181,13978217399965365452,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
6⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,5631382322071792181,13978217399965365452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,5631382322071792181,13978217399965365452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
6⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5631382322071792181,13978217399965365452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
6⤵
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5631382322071792181,13978217399965365452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
6⤵
PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5631382322071792181,13978217399965365452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
6⤵
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5631382322071792181,13978217399965365452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
6⤵
PID:2396

C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
"C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Users\Admin\AppData\Local\Temp\1000354001\a004a540be.exe
"C:\Users\Admin\AppData\Local\Temp\1000354001\a004a540be.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5508

C:\Users\Admin\AppData\Local\Temp\1000355001\bba0c3abf8.exe
"C:\Users\Admin\AppData\Local\Temp\1000355001\bba0c3abf8.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5892

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5952

C:\Users\Admin\AppData\Local\Temp\1000023001\f501b77537.exe
"C:\Users\Admin\AppData\Local\Temp\1000023001\f501b77537.exe"
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2348

C:\Users\Admin\1000026002\575dd4f678.exe
"C:\Users\Admin\1000026002\575dd4f678.exe"
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1088

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000032042\ko.ps1"
6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data
7⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe7b19cc40,0x7ffe7b19cc4c,0x7ffe7b19cc58
8⤵
PID:3192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
8⤵
PID:1328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=1976,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3
8⤵
PID:5820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=2148,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
8⤵
PID:5936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
8⤵
PID:1732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
8⤵
PID:4268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3340,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
8⤵
PID:4872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4440,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:2
8⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3940,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:2
8⤵
PID:1016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=4480,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
8⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5116,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
8⤵
PID:5900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5108,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
8⤵
PID:5892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5484,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
8⤵
PID:5760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=3208,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
8⤵
PID:6488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5596,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
8⤵
PID:6496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3308,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
8⤵
PID:6504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5492,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
8⤵
PID:6784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5988,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
8⤵
PID:6892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5972,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
8⤵
PID:7104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6108,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
8⤵
PID:6324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6272,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
8⤵
PID:6200

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
8⤵
- Drops file in Program Files directory
PID:1732

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7abbd4698,0x7ff7abbd46a4,0x7ff7abbd46b0
9⤵
- Drops file in Program Files directory
PID:6672

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
9⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:6732

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7abbd4698,0x7ff7abbd46a4,0x7ff7abbd46b0
10⤵
- Drops file in Program Files directory
PID:6752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=5432,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
8⤵
PID:6528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=3248,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
8⤵
PID:6864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=6712,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
8⤵
PID:1488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=6264,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
8⤵
PID:7016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5080,i,13671653300481401314,6623131621148175303,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:2
8⤵
PID:7888

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000033142\so.ps1"
6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data
7⤵
PID:2596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe7b19cc40,0x7ffe7b19cc4c,0x7ffe7b19cc58
8⤵
PID:6084

C:\Users\Admin\AppData\Local\Temp\1000034001\3ee1417c16.exe
"C:\Users\Admin\AppData\Local\Temp\1000034001\3ee1417c16.exe"
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:5420

C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
"C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 1284
5⤵
- Program crash
PID:5884

C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
"C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start context.exe
5⤵
PID:5756

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\context.exe
context.exe
6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7100

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
7⤵
- System Location Discovery: System Language Discovery
PID:6760

C:\Windows\SysWOW64\tasklist.exe
tasklist
8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6460

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
8⤵
- System Location Discovery: System Language Discovery
PID:6380

C:\Windows\SysWOW64\tasklist.exe
tasklist
8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6432

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
8⤵
- System Location Discovery: System Language Discovery
PID:6440

C:\Windows\SysWOW64\cmd.exe
cmd /c md 607698
8⤵
- System Location Discovery: System Language Discovery
PID:7304

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
8⤵
- System Location Discovery: System Language Discovery
PID:7344

C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
Waters.pif Q
8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7352

C:\Windows\SysWOW64\choice.exe
choice /d y /t 5
8⤵
PID:7368

C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
"C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5216

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
5⤵
- System Location Discovery: System Language Discovery
PID:4472

C:\Windows\SysWOW64\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6980

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
6⤵
- System Location Discovery: System Language Discovery
PID:6988

C:\Windows\SysWOW64\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:7088

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
6⤵
PID:7092

C:\Windows\SysWOW64\cmd.exe
cmd /c md 607698
6⤵
- System Location Discovery: System Language Discovery
PID:1708

C:\Windows\SysWOW64\findstr.exe
findstr /V "MaskBathroomCompositionInjection" Participants
6⤵
- System Location Discovery: System Language Discovery
PID:6744

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
6⤵
- System Location Discovery: System Language Discovery
PID:6880

C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
Waters.pif Q
6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6332

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k "taskkill /f /im "Waters.pif" && timeout 1 && del Waters.pif && Exit"
7⤵
- System Location Discovery: System Language Discovery
PID:6784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "Waters.pif"
8⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:7148

C:\Windows\SysWOW64\timeout.exe
timeout 1
8⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:8048

C:\Windows\SysWOW64\choice.exe
choice /d y /t 5
6⤵
- System Location Discovery: System Language Discovery
PID:6780

C:\Users\Admin\AppData\Local\Temp\1000370001\PkContent.exe
"C:\Users\Admin\AppData\Local\Temp\1000370001\PkContent.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5612

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat
5⤵
- System Location Discovery: System Language Discovery
PID:5448

C:\Windows\SysWOW64\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:6060

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
6⤵
- System Location Discovery: System Language Discovery
PID:220

C:\Windows\SysWOW64\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
6⤵
- System Location Discovery: System Language Discovery
PID:7100

C:\Windows\SysWOW64\cmd.exe
cmd /c md 724598
6⤵
- System Location Discovery: System Language Discovery
PID:3036

C:\Windows\SysWOW64\findstr.exe
findstr /V "WowLiberalCalOfficer" Weight
6⤵
- System Location Discovery: System Language Discovery
PID:3756

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y
6⤵
- System Location Discovery: System Language Discovery
PID:7316

C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif
Thermal.pif y
6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7460

C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:7564

C:\Windows\SysWOW64\choice.exe
choice /d y /t 5
6⤵
PID:8012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5212

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
2⤵
- System Location Discovery: System Language Discovery
PID:6532

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:7088

C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:6556

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:6880

C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\Admin\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit
2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:8100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1248 -ip 1248
1⤵
PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4916 -ip 4916
1⤵
PID:5688

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5368

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5660

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5716

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5816

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4012

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion